Scammers Deploy Fake Crypto AML Checkers to Hijack Wallets
What Happened — Scammers are hosting counterfeit anti‑money‑laundering (AML) verification sites that mimic legitimate services such as AMLBot. Instead of a simple public‑address lookup, the fake sites require users to connect their crypto wallet and approve a crafted transaction, allowing the attacker to drain the wallet’s funds.
Why It Matters for Compliance & Audit Readiness
- The incident is a textbook access‑control failure: users grant signing authority to an untrusted web app, violating SOC 2 CC6.1 “least‑privilege” and “logical access” requirements.
- It highlights the need for documented security‑awareness training and wallet‑use policies that explicitly prohibit signing unknown transactions—a control that can be audited under the SOC 2 “Security” Trust Services Criteria.
- Continuous monitoring of wallet‑connect events (e.g., logs of Web3 provider interactions) provides verifiable evidence that access‑control policies are enforced, supporting a defensible audit trail.
Who Is Affected — Crypto exchanges, decentralized finance (DeFi) platforms, wallet providers, and any organization that advises clients on crypto‑asset handling (FIN_SERV, TECH_SAAS).
Recommended Actions
- Update security‑awareness curricula to include crypto‑specific phishing scenarios and the “never sign unknown transactions” rule.
- Enforce a policy that AML checks must be performed via read‑only public‑address lookups; prohibit wallet connections for verification services.
- Capture and retain logs of wallet‑connect events as audit evidence for SOC 2 compliance.
Source: Malwarebytes Labs
Technical Notes — The scam leverages deceptive UI (progress bars, fake fees) and the wallet‑connect protocol to request a transaction signature. No software vulnerability (CVE) is involved; the vector is social engineering via phishing‑style malicious web pages. Source: same link