https://guptadeepak.com/scam-atlas/A sourced library of 70 cyber scam types, from pig butchering to help-desk social engineering, with real cases graded by source, loss data, and what to do.https://guptadeepak.com/scam-atlas/changelog/2026-09-24-Launch: 11 scam families, 70 scam types,Thu, 24 Sep 2026 00:00:00 GMTLaunch: 11 scam families, 70 scam types, 12 delivery techniques, 35 sourced cases, and the first quarterly trend report.https://guptadeepak.com/scam-atlas/case/daren-li-crypto-scam-laundering-2026/case-daren-li-crypto-scam-laundering-2026Mon, 09 Feb 2026 00:00:00 GMTDaren Li, 42, a dual national of China and St. Kitts and Nevis, was sentenced in absentia in the Central District of California to 20 years in prison for conspiring to launder funds from cryptocurrency scams carried out from scam centres in Cambodia. DOJ said unindicted members of the conspiracy contacted victims through unsolicited social media messages, phone calls and dating services, then steered them to fake crypto trading platforms or posed as customer support. Li directed others to open US bank accounts for shell companies that received victim money before it was converted to virtual currency. He pleaded guilty in November 2024, then cut off his ankle monitor and absconded in December 2025.https://guptadeepak.com/scam-atlas/case/operation-chakra-noida-call-centre-2025/case-operation-chakra-noida-call-centre-2025Wed, 10 Dec 2025 00:00:00 GMTIn December 2025 India's Central Bureau of Investigation, working with the FBI, raided an illegal call centre in Noida and arrested six people in an operation codenamed Operation Chakra. The FBI says the network targeted more than 600 US citizens with tech support scams and by impersonating US agencies such as the Drug Enforcement Administration and the Social Security Administration, and that victim reports to IC3 attributed more than $48.7 million in losses to it. The CBI alleges the accused posed as officials of the DEA, the FBI and the SSA, threatened that victims' assets would be frozen, and directed them to move money to crypto wallets and foreign bank accounts.https://guptadeepak.com/scam-atlas/case/scam-center-strike-force-2025/case-scam-center-strike-force-2025Wed, 12 Nov 2025 00:00:00 GMTThe US Attorney's Office for the District of Columbia, DOJ's Criminal Division, the FBI and the Secret Service launched the Scam Center Strike Force in November 2025 against Southeast Asian scam centres running crypto investment fraud on Americans, who the Secret Service says lose about $10 billion a year to such scams. At launch it had seized and forfeited $401,657,274.33 in cryptocurrency, seized websites used by the Tai Chang compound in Burma and sought warrants for the compound's satellite internet terminals. In April 2026 DOJ charged two Chinese nationals, Huang Xingshan and Jiang Wen Jie, with wire fraud conspiracy, alleging they managed the Shunda scam compound in Burma, and announced the seizure of 503 fake investment websites.https://guptadeepak.com/scam-atlas/case/prince-group-chen-zhi-charged-2025/case-prince-group-chen-zhi-charged-2025Tue, 14 Oct 2025 00:00:00 GMTAn indictment unsealed in federal court in Brooklyn charged Chen Zhi, also known as Vincent, a 37-year-old Cambodian national and the founder and chairman of Prince Holding Group, with wire fraud conspiracy and money laundering conspiracy. Prosecutors allege Prince Group ran forced-labour scam compounds in Cambodia where trafficked workers were made to run pig butchering crypto investment scams, often under threat of violence. DOJ also filed a civil forfeiture complaint against about 127,271 bitcoin, then worth about $15 billion, and the US Treasury and the UK sanctioned the group. OCCRP reported that Cambodia arrested Chen in January 2026 and extradited him to China, and that Prince Group called the allegations baseless.https://guptadeepak.com/scam-atlas/case/scattered-spider-jubair-charged-2025/case-scattered-spider-jubair-charged-2025Thu, 18 Sep 2025 00:00:00 GMTA complaint unsealed in the District of New Jersey charged Thalha Jubair, a UK national, with conspiracies to commit computer fraud, wire fraud and money laundering. The charges are in relation to at least 120 computer network intrusions and extortion involving 47 US entities, from an investigation into the group known as Scattered Spider, and the complaint alleges that victims paid at least $115 million in ransom payments. The complaint describes calls to victims' helpdesks that got representatives to reset other users' passwords. In a separate UK case, Jubair was sentenced in July 2026 over the 2024 Transport for London attack.https://guptadeepak.com/scam-atlas/case/salesloft-drift-oauth-token-theft-2025/case-salesloft-drift-oauth-token-theft-2025Fri, 08 Aug 2025 00:00:00 GMTAn attacker accessed Salesloft's GitHub account between March and June 2025, then reached Drift's AWS environment and took OAuth tokens for Drift customers' integrations. From 8 to 18 August 2025, the group Google tracks as UNC6395 used the tokens to export large volumes of data from many companies' Salesforce instances and searched it for secrets such as AWS keys and Snowflake tokens. No social engineering of staff was involved: the attacker used OAuth tokens taken from a supplier's integration, and Google said no Salesforce vulnerability was involved. The FBI grouped UNC6395 with actors behind data theft and extortion.https://guptadeepak.com/scam-atlas/case/christina-chapman-laptop-farm-2025/case-christina-chapman-laptop-farm-2025Thu, 24 Jul 2025 00:00:00 GMTChristina Marie Chapman, 50, of Litchfield Park, Arizona, was sentenced to 102 months in prison for a scheme that helped North Korean IT workers pose as US citizens and residents to get remote IT jobs at 309 US businesses and two international businesses, using 68 identities stolen from US people. DOJ said she ran a laptop farm at her home, hosting company computers so employers believed the work was done in the United States, received forged payroll checks and direct deposits, and shipped about 49 laptops overseas, including to places near the North Korea and China border. Victims included Fortune 500 companies, a major television network and an aerospace manufacturer. The scheme generated more than $17 million in illicit revenue.https://guptadeepak.com/scam-atlas/case/google-salesforce-unc6040-vishing-2025/case-google-salesforce-unc6040-vishing-2025Sun, 01 Jun 2025 00:00:00 GMTGoogle Threat Intelligence tracks UNC6040, a group that phones employees while posing as IT support and talks them into authorising a modified Salesforce Data Loader as a connected app, then exports Salesforce data for later extortion. Google disclosed that in June 2025 one of its own corporate Salesforce instances, used for small and medium business contact data, was affected by similar activity. It said the data retrieved was basic, largely public business information such as names and contact details.https://guptadeepak.com/scam-atlas/case/coinbase-insider-bribery-2025/case-coinbase-insider-bribery-2025Thu, 15 May 2025 00:00:00 GMTOn 11 May 2025 Coinbase received an email from an unknown threat actor claiming to hold customer account data and internal documents, demanding money not to publish them. Coinbase said the actor appears to have paid multiple contractors or employees in support roles outside the US to collect data from internal systems. The data included names, contact details, masked Social Security and bank numbers, and government ID images, but no passwords, private keys or funds. Coinbase did not pay and estimated costs of $180 million to $400 million. BleepingComputer reported the demand was $20 million and that a former support agent was later arrested in India.https://guptadeepak.com/scam-atlas/case/senior-us-officials-ai-voice-impersonation-2025/case-senior-us-officials-ai-voice-impersonation-2025Thu, 15 May 2025 00:00:00 GMTThe FBI warned in May 2025 that since April 2025 malicious actors had sent texts and AI-generated voice messages claiming to come from senior US officials, targeting many current or former federal and state officials and their contacts, to gain access to personal accounts. In July 2025 US media reported a State Department cable saying an unknown actor using a Signal account with the display name marco.rubio@state.gov had contacted at least five people, including three foreign ministers. In December 2025 the FBI said activity dating back to 2023 had impersonated state, White House and Cabinet level officials, moving targets to Signal, Telegram or WhatsApp and asking for authentication codes, identity documents, money or introductions.https://guptadeepak.com/scam-atlas/case/co-op-harrods-cyber-attacks-2025/case-co-op-harrods-cyber-attacks-2025Wed, 30 Apr 2025 00:00:00 GMTDays after the attack on M&S, the Co-op shut down parts of its IT systems and Harrods said it had seen attempts to gain unauthorised access to its systems. Co-op's chief executive said the attackers accessed member data, and Co-op later estimated a first-half hit of £206 million in revenue and £80 million in costs and lost profit. Co-op has not published how the attackers got in; Help Net Security reported they apparently social-engineered an employee and took over the account by resetting its password. The NCA arrested four people in July 2025 over the M&S, Co-op and Harrods attacks.https://guptadeepak.com/scam-atlas/case/marks-and-spencer-cyber-attack-2025/case-marks-and-spencer-cyber-attack-2025Thu, 17 Apr 2025 00:00:00 GMTM&S chairman Archie Norman told a UK parliamentary sub-committee that attackers first got in on 17 April 2025 through a sophisticated impersonation that involved a third party, and BleepingComputer reported he said they tricked a third party into resetting an employee's password. M&S paused online orders and in May estimated a £300 million hit to operating profit before mitigation and insurance. The NCA arrested four people in July 2025 over the M&S, Co-op and Harrods attacks.https://guptadeepak.com/scam-atlas/case/bybit-lazarus-safe-wallet-2025/case-bybit-lazarus-safe-wallet-2025Fri, 21 Feb 2025 00:00:00 GMTOn or about 21 February 2025, attackers took about $1.5 billion in virtual assets from the cryptocurrency exchange Bybit, and the FBI attributed the theft to North Korea, calling the activity TraderTraitor. Safe, whose multisignature wallet interface Bybit's signers used, said in a statement quoted by BleepingComputer that the attack came through a compromised Safe{Wallet} developer machine, and researchers found malicious JavaScript injected into app.safe.global that disguised the transaction the signers approved. Crypto.news, citing Safe's investigation with Mandiant, reported the developer's Mac was infected on 4 February by a Docker project posing as a stock investment simulator, after which the attackers used stolen AWS session tokens to get past MFA.https://guptadeepak.com/scam-atlas/case/hong-kong-deepfake-romance-syndicate-2024/case-hong-kong-deepfake-romance-syndicate-2024Mon, 14 Oct 2024 00:00:00 GMTHong Kong police announced on 14 October 2024 that they had arrested 27 people for conspiracy to defraud after raiding a 4,000 square foot scam centre in Hung Hom. Police said the syndicate first sent AI-generated photos to people met on social media, then used deepfake technology on video calls to turn scammers into attractive women, and steered victims into investing in cryptocurrency on fraudulent trading platforms; police and press reports said the syndicate recruited university graduates to build them. The Hong Kong government later told the Legislative Council the triad-linked syndicate targeted victims in Hong Kong, the Mainland and elsewhere in Asia, and that the case involved more than HK$360 million.https://guptadeepak.com/scam-atlas/case/ogoshi-brothers-sextortion-2024/case-ogoshi-brothers-sextortion-2024Thu, 05 Sep 2024 00:00:00 GMTSamuel Ogoshi and Samson Ogoshi, brothers, were each sentenced in the Western District of Michigan to 210 months in prison after pleading guilty to conspiracy to sexually exploit minors. The indictment alleged that the defendants posed as young women on social media, got teenage boys to send sexually explicit images, then blackmailed them for money by threatening to send the images to their families, friends and classmates. It also alleged that Samuel Ogoshi, using an Instagram persona, did this to a 17-year-old in Michigan who died by suicide in March 2022; his judgment records that count as dismissed on the government's motion.https://guptadeepak.com/scam-atlas/case/tfl-helpdesk-2024/case-tfl-helpdesk-2024Sat, 31 Aug 2024 00:00:00 GMTBetween 31 August and 3 September 2024, attackers infiltrated Transport for London's network, rendering more than 140 systems inoperable, accessing Oyster refunds data and costing TfL a reported £29 million. The Register reported that Woolwich Crown Court heard the attackers impersonated an employee and socially engineered a TfL helpdesk worker into resetting a password. Thalha Jubair, described by the NCA as a member of Scattered Spider, pleaded guilty along with a second defendant, a minor at the time of the attack, and each was sentenced to five years and six months.https://guptadeepak.com/scam-atlas/case/heartland-tri-state-bank-shan-hanes-2024/case-heartland-tri-state-bank-shan-hanes-2024Mon, 19 Aug 2024 00:00:00 GMTShan Hanes, 53, of Elkhart, Kansas, the former chief executive of Heartland Tri-State Bank, was sentenced to 293 months in prison after pleading guilty to embezzlement by a bank officer. The FDIC Office of Inspector General said that between May and July 2023 he initiated 11 outgoing wire transfers totalling $47.1 million of the bank's funds to a cryptocurrency wallet in a scheme referred to as pig butchering. Kansas regulators closed the bank on 28 July 2023. Hanes's lawyer argued he was himself a scam victim; an FBI agent said the bank's job was to protect its customers from fraudulent scams, not to participate in them.https://guptadeepak.com/scam-atlas/case/ferrari-ceo-deepfake-attempt-2024/case-ferrari-ceo-deepfake-attempt-2024Fri, 26 Jul 2024 00:00:00 GMTIn July 2024 a Ferrari executive received WhatsApp messages, from an unfamiliar number, that appeared to come from CEO Benedetto Vigna and mentioned a big acquisition and an NDA. A follow-up call used a convincing imitation of Vigna's voice to push a confidential currency-hedge transaction. The executive noticed slight mechanical intonations and asked which book Vigna had recently recommended to him; the call ended. Bloomberg reported this from people familiar with the episode, and Ferrari declined to comment.https://guptadeepak.com/scam-atlas/case/knowbe4-north-korean-fake-it-worker-2024/case-knowbe4-north-korean-fake-it-worker-2024Mon, 15 Jul 2024 00:00:00 GMTKnowBe4 hired a remote principal software engineer for its internal IT AI team after four video interviews and background checks, which came back clear because the person used a valid but stolen US-based identity, with a photo that was AI enhanced from stock photography. On 15 July 2024, soon after the company workstation arrived, KnowBe4's EDR software detected the person loading malware, and its security team contained the device about 25 minutes after the activity began. KnowBe4 said no illegal access was gained and no data was lost, identified the hire as a North Korean fake IT worker, and shared its findings with Mandiant and the FBI.https://guptadeepak.com/scam-atlas/case/storm-1811-email-bombing-quick-assist-2024/case-storm-1811-email-bombing-quick-assist-2024Wed, 15 May 2024 00:00:00 GMTFrom mid-April 2024 Microsoft observed Storm-1811, a group known to deploy Black Basta ransomware, flooding targets' inboxes by signing them up to many subscriptions, then phoning as IT support to fix the spam. Callers talked users into opening Quick Assist and entering a code, then installed tools leading to Black Basta. From late May the group also used Microsoft Teams accounts named as help desk. CISA and the FBI later added the email bombing and Teams tactics to their Black Basta advisory.https://guptadeepak.com/scam-atlas/case/wpp-ceo-voice-clone-attempt-2024/case-wpp-ceo-voice-clone-attempt-2024Fri, 10 May 2024 00:00:00 GMTFraudsters created a WhatsApp account using a public photo of WPP CEO Mark Read and used it to set up a Microsoft Teams meeting that appeared to include him and another senior executive. In the meeting they used a voice clone and YouTube footage of the executive, and impersonated Read in the chat. They targeted an agency leader, asking them to set up a new business to solicit money and personal details. The Guardian reported Read's internal email; a WPP spokesperson said the attempt was prevented.https://guptadeepak.com/scam-atlas/case/powell-sim-swap-ring-400-million-2024/case-powell-sim-swap-ring-400-million-2024Thu, 18 Jan 2024 00:00:00 GMTA federal grand jury in Washington, DC indicted Robert Powell, Carter Rohn and Emily Hernandez on charges of conspiracy to commit wire fraud and conspiracy to commit aggravated identity theft and access device fraud. The indictment alleges that from around March 2021 to April 2023 the group used stolen personal data and fake IDs to have victims' phone numbers moved to devices they controlled. It alleges that on 11 November 2022 Powell had co-conspirators SIM swap an employee of Victim Company-1, that Hernandez used a fake ID bearing her photo at a phone store in Texas, and that co-conspirators then moved over $400 million in virtual currency out of the company's wallets. The indictment does not name FTX; KrebsOnSecurity and other press linked the theft to FTX, which filed for bankruptcy that day.https://guptadeepak.com/scam-atlas/case/arup-deepfake-cfo-2024/case-arup-deepfake-cfo-2024Mon, 01 Jan 2024 00:00:00 GMTIn January 2024 a finance employee in Arup's Hong Kong office received a message about a confidential transaction that appeared to come from the UK-based CFO, followed by a video conference in which the CFO and other staff were deepfakes built from public video and audio. The employee made 15 transfers totalling HK$200 million to five Hong Kong bank accounts. Police described the case in February without naming the company; Arup confirmed in May that fake voices and images were used.https://guptadeepak.com/scam-atlas/case/caesars-it-vendor-social-engineering-2023/case-caesars-it-vendor-social-engineering-2023Thu, 14 Sep 2023 00:00:00 GMTCaesars Entertainment disclosed in September 2023 that suspicious activity in its network resulted from a social engineering attack on an outsourced IT support vendor. The attacker acquired a copy of its loyalty program database, including driver's licence and Social Security numbers for a significant number of members. Caesars said it had taken steps to ensure the stolen data was deleted but could not guarantee it. TechCrunch relayed a Wall Street Journal report that Caesars paid about half of a $30 million demand.https://guptadeepak.com/scam-atlas/case/mgm-resorts-helpdesk-2023/case-mgm-resorts-helpdesk-2023Tue, 12 Sep 2023 00:00:00 GMTIn September 2023 MGM Resorts shut down systems after a cyberattack, disrupting some of its properties. MGM later estimated a negative impact of about $100 million to Adjusted Property EBITDAR and said the attackers obtained personal information of some customers who transacted before March 2019. MGM did not say how the attackers got in; the Scattered Spider group claimed responsibility and, as TechCrunch reported, told vx-underground it found an employee on LinkedIn and called the help desk to access their account.https://guptadeepak.com/scam-atlas/case/retool-2023-smishing-voice-call/case-retool-2023-smishing-voice-callSun, 27 Aug 2023 00:00:00 GMTOn 27 August 2023 several Retool employees received texts claiming an account issue would block healthcare open enrollment, linking to a fake internal identity portal. One employee logged in, then took a call from someone claiming to be IT who, in Retool's words, deepfaked "our employee's actual voice" and obtained one more MFA code. Because the employee's Google Authenticator codes synced to the cloud, the attacker reached internal admin tools and took over 27 cloud customer accounts, all in the crypto industry.https://guptadeepak.com/scam-atlas/case/inferno-drainer-2022/case-inferno-drainer-2022Tue, 01 Nov 2022 00:00:00 GMTGroup-IB says Inferno Drainer was a scam-as-a-service operation active from November 2022 until an announced shutdown in November 2023. Its developers offered phishing infrastructure that impersonated more than 100 cryptocurrency brands across more than 16,000 unique domains, luring users to connect their wallets and approve malicious transactions, and took 20% of the proceeds while the affiliates using it kept 80%. Group-IB, citing ScamSniffer data, linked it to more than $80 million in digital assets taken from victims. Check Point later reported that it kept operating, with more than 30,000 wallets hit and at least $9 million lost between September 2024 and March 2025, partly through a fake Discord verification bot.https://guptadeepak.com/scam-atlas/case/uber-2022-mfa-fatigue/case-uber-2022-mfa-fatigueThu, 15 Sep 2022 00:00:00 GMTIn September 2022 an attacker who likely bought an Uber contractor's corporate password on the dark web tried to log in again and again, triggering two-factor approval requests, until the contractor accepted one. Uber said the attacker then reached other employee accounts, gained elevated permissions to tools including G-Suite and Slack, and downloaded some internal Slack messages and information from an internal finance tool used to manage some invoices. Uber linked the attacker to the Lapsus$ group.https://guptadeepak.com/scam-atlas/case/twilio-2022-employee-smishing/case-twilio-2022-employee-smishingThu, 04 Aug 2022 00:00:00 GMTFrom mid-July 2022, hundreds of text messages posing as Twilio IT told current and former employees that their passwords had expired or schedules had changed, linking to fake Okta login pages on look-alike domains. Some employees entered their credentials, and the attackers used them to reach internal tools and customer data. Twilio found 209 customers and 93 Authy users affected, and noted researchers had tied the campaign to attacks on many other companies, dubbed 0ktapus.https://guptadeepak.com/scam-atlas/case/cisco-2022-vishing-mfa-fatigue/case-cisco-2022-vishing-mfa-fatigueTue, 24 May 2022 00:00:00 GMTAn attacker took over a Cisco employee's personal Google account, where saved browser passwords, including Cisco credentials, were synchronised. To get past MFA the attacker made voice phishing calls over several days, posing as trusted support organisations, and sent repeated push requests until one was accepted. Cisco Talos said the attacker reached the VPN, escalated privileges and took the contents of one Box folder and Active Directory authentication data, but no ransomware was deployed.https://guptadeepak.com/scam-atlas/case/ahmedabad-irs-uscis-call-centres-2020/case-ahmedabad-irs-uscis-call-centres-2020Mon, 30 Nov 2020 00:00:00 GMTHitesh Madhubhai Patel, also known as Hitesh Hinglaj, 44, of Ahmedabad, India, was sentenced in the Southern District of Texas to 20 years in prison for operating and funding India-based call centres that defrauded US victims between 2013 and 2016. According to his plea agreement, callers impersonated officials of the IRS and US Citizenship and Immigration Services and threatened victims with arrest, imprisonment, fines or deportation unless they paid, often by buying general purpose reloadable cards or wiring money; US-based runners then liquidated and laundered the funds. The 2016 indictment charged Patel and 60 other people and entities, and 24 US-based defendants had already been convicted and sentenced.https://guptadeepak.com/scam-atlas/case/twitter-2020-help-desk-vishing/case-twitter-2020-help-desk-vishingWed, 15 Jul 2020 00:00:00 GMTOn 14 and 15 July 2020, callers claiming to be from Twitter's IT help desk phoned employees about VPN problems and steered them to a phishing site that copied the real VPN login. With the captured credentials the hackers reached internal account tools, compromised 130 accounts and posted a bitcoin scam from high-profile ones. The New York Department of Financial Services found they took over $118,000 in bitcoin. Joseph James O'Connor was sentenced in 2023 for his role in the conspiracy.https://guptadeepak.com/scam-atlas/case/rimasauskas-google-facebook-invoice-fraud-2019/case-rimasauskas-google-facebook-invoice-fraud-2019Thu, 19 Dec 2019 00:00:00 GMTEvaldas Rimasauskas, a Lithuanian national, registered a company in Latvia with a name resembling Quanta Computer, a Taiwan-based hardware maker, and from 2013 to 2015 he and others sent emails and fake invoices to employees of two US internet companies asking for payments to bank accounts in Latvia and Cyprus, from which money was moved on through several countries. Google and Facebook confirmed in 2017 that they were the victims. Rimasauskas was arrested in Lithuania in March 2017, extradited to the United States, pleaded guilty to wire fraud in 2019 and was sentenced to five years in prison, with forfeiture of about $49.7 million and restitution of about $26.5 million.https://guptadeepak.com/scam-atlas/case/toyota-boshoku-europe-payment-fraud-2019/case-toyota-boshoku-europe-payment-fraud-2019Wed, 14 Aug 2019 00:00:00 GMTToyota Boshoku Corporation announced on 6 September 2019 that fraudulent payment directions from a malicious third party had caused a financial loss at its European subsidiary on 14 August, with an expected loss of up to about 4 billion yen. The company said it realised the directions were fraudulent shortly after the funds left, set up a team of legal professionals, reported the loss to local investigators and was working to secure and recover the funds, but gave no further details to protect the investigation. Security press, including BleepingComputer, reported it as business email compromise; the company did not say who the sender claimed to be.https://guptadeepak.com/scam-atlas/case/ubiquiti-employee-impersonation-fraud-2015/case-ubiquiti-employee-impersonation-fraud-2015Fri, 05 Jun 2015 00:00:00 GMTOn 5 June 2015 Ubiquiti Networks determined it had been the victim of a criminal fraud involving employee impersonation and fraudulent requests from an outside entity targeting its finance department, which law enforcement calls business email compromise. The fraud led to transfers totalling $46.7 million, held by a Hong Kong subsidiary, to overseas accounts held by third parties. An audit committee investigation found no evidence that Ubiquiti's systems were penetrated or of employee criminal involvement, but the company concluded its internal control over financial reporting was ineffective. Ubiquiti later reported recovering $16.7 million.