{"investigation":{"slug":"fake-crypto-aml-checker-drainer-campaign","entity_name":"Fake Crypto AML Checker Drainer Campaign","trust_score":1,"severity_base":null,"score_modifier":0,"confidence":0.75,"status":"draft","content_type":"investigation","summary":"A coordinated campaign of fraudulent websites impersonating cryptocurrency AML (anti-money-laundering) compliance-check services — most prominently the legitimate provider AMLBot, alongside generic \"AML Check\" branding — has been documented by cybersecurity firm Malwarebytes and corroborated by multiple crypto and security news outlets since August 2026. The sites lure users into connecting wallets under the pretext of a compliance scan and then induce them to approve malicious transactions or token permissions that drain their assets. This is an assessment of the scam campaign and its known malicious infrastructure, not of AMLBot itself, which appears to be an impersonated victim brand rather than a perpetrator.","sections":[{"content":"According to a threat intelligence report published by Malwarebytes on August 19, 2026, scammers are operating a network of fake cryptocurrency AML/compliance-checking websites that mimic the branding, layout, and language of legitimate wallet-screening services such as AMLBot, while others use generic names like \"AML Check.\" Malwarebytes described these as reuses of the same malicious template repackaged under different names and logos. Victims are prompted to connect a crypto wallet so the site can perform a purported compliance or risk scan; the site then uses the revealed public address to generate a transaction or token-approval request tailored to that wallet, which the victim is induced to sign. Approving the request allows the attackers to move the victim's assets to wallets under their control. The sites reinforce the illusion of legitimacy with fake progress indicators such as \"Checking wallet history…\" and \"Verifying compliance…\", and in some cases display fabricated results (e.g., \"Clean, Low Risk\") or demand a small fee before showing a result.","heading":"Overview of the scheme","sources":[{"url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet","name":"Malwarebytes Threat Intel — \"Scammers are using fake crypto AML checkers to drain your wallet\"","type":"research","credibility":2},{"url":"https://decrypt.co/376029/fake-crypto-aml-drain-users-wallets","name":"Decrypt — \"Fake Crypto AML Checkers Are Trying to Drain Users' Wallets\"","type":"news_article","credibility":2},{"url":"https://securityboulevard.com/2026/09/scammers-running-fake-cryptocurrency-aml-wallet-checking-sites-hoodwink-users-drain-wallets/","name":"Security Boulevard — \"Scammers Running Fake Cryptocurrency AML Wallet-checking Sites Hoodwink Users, Drain Wallets\"","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Multiple sources report that the campaign frequently impersonates AMLBot, a legitimate wallet-screening and compliance service, by copying its logo, layout, and language, alongside sites using generic \"AML Check\" naming. A separate malware-removal reference (PCRisk), originally published June 2, 2026 and updated through December 2026, catalogued a related set of fraudulent domains impersonating AMLBot, including amlbotchecking[.]com, aml-bot.co[.]com, aml-safety[.]one, amlnix[.]com, and amlbot[.]club. Malwarebytes separately identified additional malicious domains associated with the broader campaign, including amlbot-clear[.]com, audittrust[.]shop, bitget-aml[.]com, search-aml[.]net, and swapstoken[.]app. There is no evidence in available reporting that AMLBot itself, as a company, is complicit in the scam; it appears to be a targeted impersonation victim whose brand recognition is being exploited to lend the fake sites credibility.","heading":"Impersonation of AMLBot and other legitimate services","sources":[{"url":"https://www.pcrisk.com/removal-guides/33236-amlbot-crypto-checking-scam","name":"PCRisk — \"AMLBot Crypto Checking Scam - Removal and recovery steps\"","type":"community_report","credibility":3},{"url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet","name":"Malwarebytes Threat Intel — \"Scammers are using fake crypto AML checkers to drain your wallet\"","type":"research","credibility":2}],"severity":"high"},{"content":"Reporting is consistent that the core deception is a wallet-drainer disguised as a compliance workflow: legitimate AML/wallet-screening only requires a public wallet address, not a wallet connection, signature, or fee. Malwarebytes stated: \"If an AML checker asks you to connect your wallet rather than simply enter its public address, treat that as a warning sign.\" A follow-up Security Boulevard article (published September 1, 2026) quoted security researchers characterizing the technique as social-engineering that weaponizes compliance itself: Sectigo Senior Fellow Jason Soroko was quoted saying \"This scam turns compliance into the lure,\" and Black Duck's Robert Coles noted \"No exploit is needed if the person hands over the keys voluntarily,\" comparing the pattern to OAuth consent-phishing. These secondary analyses did not identify a new technical mechanism beyond what Malwarebytes originally reported, but they corroborate that the drain occurs through the victim's own transaction approval rather than a wallet exploit.","heading":"Attack mechanism and technical red flags","sources":[{"url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet","name":"Malwarebytes Threat Intel — \"Scammers are using fake crypto AML checkers to drain your wallet\"","type":"research","credibility":2},{"url":"https://securityboulevard.com/2026/09/scammers-running-fake-cryptocurrency-aml-wallet-checking-sites-hoodwink-users-drain-wallets/","name":"Security Boulevard — \"Scammers Running Fake Cryptocurrency AML Wallet-checking Sites Hoodwink Users, Drain Wallets\"","type":"news_article","credibility":2}],"severity":"high"},{"content":"No source reviewed provided a specific dollar figure for losses attributable to this particular fake-AML-checker campaign, nor did any source name the individual(s) or group operating it. Coverage from Decrypt, Cryptopolitan, and KuCoin's news flash largely republished or summarized the Malwarebytes findings without adding independently verified loss data or attribution. Given the absence of confirmed attribution or quantified victim losses in available reporting, the scale and identity of the operators should be considered unverified.","heading":"Scale, victim losses, and attribution","sources":[{"url":"https://decrypt.co/376029/fake-crypto-aml-drain-users-wallets","name":"Decrypt — \"Fake Crypto AML Checkers Are Trying to Drain Users' Wallets\"","type":"news_article","credibility":2},{"url":"https://www.kucoin.com/news/flash/fake-aml-websites-steal-crypto-assets-by-luring-users-to-connect-wallets","name":"KuCoin News Flash — \"Fake AML websites steal crypto assets by luring users to connect their wallets\"","type":"news_article","credibility":2},{"url":"https://www.cryptopolitan.com/fake-crypto-aml-checkers-drain-wallets/","name":"Cryptopolitan — \"Fake crypto AML checkers push users to approve wallet-draining transactions\"","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Malwarebytes' guidance, echoed across secondary coverage, advises that any AML/compliance tool requesting a wallet connection (rather than only a public address) should be treated as a red flag. For users who have already interacted with such a site: if only a wallet connection occurred, disconnect immediately; if token access was approved, revoke the permission via a wallet-permission checker; if a transaction was confirmed, monitor the wallet and move remaining assets to a new wallet as a precaution; and if a recovery phrase or private key was entered, the wallet should be considered fully compromised and all assets migrated to a newly generated wallet. Users are also warned to be wary of any party subsequently offering paid \"recovery\" services, a common secondary scam.","heading":"Recommended protective actions for users","sources":[{"url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet","name":"Malwarebytes Threat Intel — \"Scammers are using fake crypto AML checkers to drain your wallet\"","type":"research","credibility":2}],"severity":"low"}],"timeline":[{"date":"2026-06","event":"A malware-removal reference site (PCRisk) first published a guide describing an \"AMLBot Crypto Checking Scam\" impersonating the AMLBot brand, cataloguing associated fraudulent domains.","source":"PCRisk","source_url":"https://www.pcrisk.com/removal-guides/33236-amlbot-crypto-checking-scam"},{"date":"2026-08-19","event":"Malwarebytes published a threat intelligence report, \"Scammers are using fake crypto AML checkers to drain your wallet,\" detailing the campaign's mechanics and listing malicious domains.","source":"Malwarebytes","source_url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet","date_evidence":"by Stefan Dasic | August 19, 2026"},{"date":"2026-08","event":"Crypto and tech news outlets, including Decrypt, Cryptopolitan, and KuCoin's news flash service, republished and summarized the Malwarebytes findings, extending public awareness of the campaign.","source":"Decrypt","source_url":"https://decrypt.co/376029/fake-crypto-aml-drain-users-wallets"},{"date":"2026-09-01","event":"Security Boulevard published a follow-up article featuring additional expert commentary (Sectigo, DataVisor, Black Duck) framing the campaign as a consent-phishing-style social engineering attack.","source":"Security Boulevard","source_url":"https://securityboulevard.com/2026/09/scammers-running-fake-cryptocurrency-aml-wallet-checking-sites-hoodwink-users-drain-wallets/","date_evidence":"Publication Date: September 1, 2026"}],"sources_used":[{"url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet","name":"Malwarebytes Threat Intel — \"Scammers are using fake crypto AML checkers to drain your wallet\"","type":"research","archive_url":"http://web.archive.org/web/20260912145701/https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet","credibility":2,"archive_timestamp":"2026-09-12T14:57:01+00:00"},{"url":"https://decrypt.co/376029/fake-crypto-aml-drain-users-wallets","name":"Decrypt — \"Fake Crypto AML Checkers Are Trying to Drain Users' Wallets\"","type":"news_article","archive_url":"http://web.archive.org/web/20260830023858/https://decrypt.co/376029/fake-crypto-aml-drain-users-wallets","credibility":2,"archive_timestamp":"2026-08-30T02:38:58+00:00"},{"url":"https://securityboulevard.com/2026/09/scammers-running-fake-cryptocurrency-aml-wallet-checking-sites-hoodwink-users-drain-wallets/","name":"Security Boulevard — \"Scammers Running Fake Cryptocurrency AML Wallet-checking Sites Hoodwink Users, Drain Wallets\"","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.pcrisk.com/removal-guides/33236-amlbot-crypto-checking-scam","name":"PCRisk — \"AMLBot Crypto Checking Scam - Removal and recovery steps\"","type":"community_report","archive_url":"http://web.archive.org/web/20260614164907/https://www.pcrisk.com/removal-guides/33236-amlbot-crypto-checking-scam","credibility":3,"archive_timestamp":"2026-06-14T16:49:07+00:00"},{"url":"https://www.kucoin.com/news/flash/fake-aml-websites-steal-crypto-assets-by-luring-users-to-connect-wallets","name":"KuCoin News Flash — \"Fake AML websites steal crypto assets by luring users to connect their wallets\"","type":"news_article","archive_url":"https://web.archive.org/web/20260919125733/https://www.kucoin.com/news/flash/fake-aml-websites-steal-crypto-assets-by-luring-users-to-connect-wallets","credibility":2,"archive_timestamp":"2026-09-19T12:57:33+00:00"},{"url":"https://www.cryptopolitan.com/fake-crypto-aml-checkers-drain-wallets/","name":"Cryptopolitan — \"Fake crypto AML checkers push users to approve wallet-draining transactions\"","type":"news_article","archive_url":"http://web.archive.org/web/20260825025836/https://www.cryptopolitan.com/fake-crypto-aml-checkers-drain-wallets/","credibility":2,"archive_timestamp":"2026-08-25T02:58:36+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-19T12:22:26.361623+00:00","updated_at":"2026-09-19T14:10:19.00177+00:00"}}