A phishing campaign is reportedly targeting French taxpayers who hold cryptocurrency, with the aim of draining their wallets. Be wary of websites claiming to offer “simplified online tax returns.” We explain everything here.
A crypto phishing campaign targets French taxpayers
These cycles don’t just affect the cryptocurrency market; they also affect criminals lying in wait to empty their victims’ wallets during annual events, such as tax filing season.
A tax process complex enough to allow for seemingly convenient shortcuts, such as a “simplified online tax return.” The problem? These sites, which appear legitimate at first glance, often serve as bait to lure cryptocurrency holders into targeted phishing scams.
Example of an interface posing as an official tax website
This reality was recently brought to light by the digital investigation and cybersecurity site Osgard, as part of an in-depth investigation into an “Inferno Drainer campaign targeting French taxpayers” currently underway.
This report details a new phishing campaign using Inferno Drainer to specifically target French taxpayers who hold cryptocurrencies, via fake websites mimicking the tax portal. The attackers are capitalizing on the current news regarding wallet taxation to encourage victims to “declare” their assets by connecting their wallets, turning this administrative step into a fund-draining operation.
Osgard
A worrying escalation in the exploitation of regulatory news
In practice, this phishing campaign relies on the use of the Inferno Drainer software, a ready-to-use Drainer-as-a-Service designed to allow any unscrupulous individual to build a turnkey phishing scheme to trap overly trusting victims.
According to estimates by experts at the Osgard website, the detected campaign—which is still ongoing—has already involved “more than 30,000 victims and $9 million in losses over the past six months,” as part of what appears to be “a worrying escalation in the exploitation of regulatory news.”
Indeed, criminals are taking advantage of the complexity and current tax changes to try to deceive taxpayers by offering to connect their crypto wallets to automatically calculate their taxable amounts, which results in the immediate and irreversible siphoning of funds.
Beyond the direct financial risk to users (Inferno Drainer has already caused millions of dollars in losses), this campaign threatens trust in government online services and demonstrates the ability of threat actors to rapidly repurpose criminal infrastructure.
Osgard
So far, Osgard specialists have clearly identified three sites. The best way to avoid this is to never connect your crypto wallet to a site whose authenticity is unclear; it is best to always start from the official tax agency website.
