Head of Corporate Responsibility and Public Policy

Malware Researcher

Gen Archives

As digital currencies have rapidly grown, so have cryptocurrency scams, presenting significant risks to crypto investors and users. These scams often attract individuals with promises of high returns or use sophisticated schemes to defraud even the most cautious. Understanding these scams is crucial for protecting potential victims and safely navigating the evolving cryptocurrency scene. With the advent of artificial intelligence (AI) and deepfake technology, scams exploiting famous personalities and major events have significantly increased since these technologies enable the creation of realistic but fake videos. Consequently, dozens of scams try to leverage the popularity and credibility of celebrities or significant events to deceive as many people as possible.Scammers use various media to distribute fake pages and videos. By using different platforms, they can reach a large audience and increase the probability of attracting more people with fraudulent content. The first documented medium used by scammers for this purpose was X, at the time Twitter, in 2018. Specifically, scammers took over three popular and verified Twitter accounts of British fashion retailer Matalan, film distributor Pathe UK, and US publisher Pantheon Books. The attackers used Elon Musk’s name and likeness to promote a fraud ad via Tweets. <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#reference">[1]</a>. Since at least 2019, hackers have also been hijacking high-profile YouTube channels to broadcast cryptocurrency scams.In an effort to combat these hijacks, Google has spent considerable time researching techniques used by hackers-for-hire that were used to compromise thousands of YouTube creators. Nevertheless, this has not completely stopped scammers, who still manage to hijack accounts from time to time <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#reference">[2, 3]</a>. The issue gained enough importance to attract the interest of other researchers, motivating several scientific publications that tried to address the issue of crypto scams on various platforms, starting from the aforementioned YouTube and Twitter and including other platforms that have gained prominence in recent years, such as TikTok, Telegram, and WhatsApp <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#reference">[4-9]</a>.It is to no one’s surprise that these sources describe very similar modus operandi and associated techniques across all these platforms. The deepfakes utilizing AI are naturally becoming key instruments in crypto scam campaigns. In recent years, there has been an increasing incidence of one specific scam based on giveaway events announced by abused events and well-known personalities. The group we dubbed CryptoCore has become famous for its sophisticated tactics and successful exploitation of unsuspecting victims. This scam group and its giveaway campaigns leverage deepfake technology, hijacked YouTube accounts, and professionally designed websites to deceive users into sending their cryptocurrencies to the scammers’ wallets.This report delves into the intricacies of the CryptoCore group’s scam and analyses their modus operandi. We will describe key exploited events, including hijacked YouTube accounts and deepfake videos, alongside a technical analysis of the fraudulent sites. One purpose of this study is to present a fundamental analysis – and key statistics – of fraudulent wallets that have received profits in the millions of dollars, as well as provide statistical data on detections, showing how victims are lured into suspicious websites and ultimately end up crypto scam victims.By gathering information and insights on the CryptoCore group’s operations and giveaway scams to better understand how they operate and how they manipulate victims, we hope to help counter their operations and protect the digital world.Table of Content<ol><li data-list-item-id="e53c3b394b53e8aa3de4d38ae2b8f74a9"><a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#modus-operandi">Modus Operandi</a></li><li data-list-item-id="e2af8240d81165dfd2c89bdb5af95e8b2"><a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#Reconstructing-Scammer-Operation">Reconstructing the Scammers’ Operation</a></li><li data-list-item-id="efda88c79f4f263c4b28c28bcca0c3ec7"><a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#crypto-wallet-analysis">Crypto Wallet Analysis</a></li><li data-list-item-id="e859142d81c93ce39c57ddaaec6ff8f0e"><a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#hijacked-yt-accounts">Hijacked YouTube Accounts</a></li><li data-list-item-id="ecd1196fe140d0f65695018c665af14a9"><a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#video-policy">Video Policy &amp; Providers’ Safeguards</a></li><li data-list-item-id="e3cf66af34892a94760dbfd991a781da4"><a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#abused-events">Abused Events</a></li><li data-list-item-id="e53fc21ef96865573337ecce62ded4c8a"><a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#deepfake-videos">Use of Deepfake Videos</a></li><li data-list-item-id="e56151880f632a9b4703b89c6604f0ca3"><a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#technical-analysis">Technical Analysis</a></li><li data-list-item-id="e36d26ec76cfdedac46b3e2d408b84314"><a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#detections">Detections</a></li><li data-list-item-id="e2647f179f00f646a8fecd9bc0f825e0c"><a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#conclusion">Conclusion</a></li></ol><h4 class="text-align-justify" id="modus-operandi">Modus Operandi</h4>The primary attack vector relies on a simple exploitation of trust in established brands and famous individuals as well as the interest in major cultural and political events. The most common method is convincing a potential victim that messages or events published online are official communication from a trusted social media account or event page, thereby piggybacking on the trust associated with the chosen brand, person, or event. This initial vector usually directs the victim to a fake website that promises quick and easy profits. To pressure the victim even more, they often use limited time “giveaway” offers that urge the person to complete a quick action. Otherwise, they will allegedly lose the opportunity for a quick profit.The initial attack vector most commonly manifests as events where famous people invest a certain sum of money to raise awareness about an allegedly promising cryptocurrency that targets new cryptocurrency users. They often try to add further confusion and make the distinction more difficult by associating themselves with actual events, usually related to technology, such as space flights or fake seminars focused on cryptocurrencies.The success of the CryptoCore group is driven by their extensive preparation before an abused event, sophisticated infrastructure, and ability to expose fraudulent content to as many people as possible via popular social platforms.Before publishing malicious content, usually a video with a QR code linking to a fraudulent website, attackers must set up an environment for sharing their content, which, if successful, will lead victims to the fake page. They need to hijack an account with many subscribers/followers. Documented cases of successful hacks on YouTube users with large follower bases usually begin through phishing or malware in emails; the malware can then steal the session or credentials. The phishing email might inform the account holder, for instance, about changes in YouTube’s terms or propose cooperation in advertising on the account holder’s YouTube account <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#reference">[2]</a>. A similar approach is used for account holders on other popular social platforms.The attackers prepare deepfake content in advance and wait for an opportunity that can attract a larger audience. On the day of the event, they modify the account by changing the background and description and adding fake content to enhance authenticity. Finally, they wait for victims to search for the official event. Given the high number of subscribers of the hijacked account, there is a high probability that the search results will predominantly show fake content. Keywords related to the targeted events, combined with a large number of followers/subscribers, place hijacked accounts in the top search results.Once the victim is convinced that this is a unique event, they are redirected to the fraud website, which is highly professional-looking including “technical support” available via online chat. Additionally, the instructions, rules of the “unique event”, and crypto wallets are present on the website, including a fake transaction system to make the page appear more legitimate. The catch is that – if the victims send the money – there is no way to retrieve it back.

<h4 class="text-align-justify" id="Reconstructing-Scammer-Operation">Reconstructing the Scammers’ Operation</h4>Based on the assessed <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#modus-operandi">modus operandi</a>, we see strong indications of a large and complex scam operation using a vast array of techniques and scam methods. Their techniques utilize several key tools essential to their campaigns’ success.

The first step is to attract the largest audience and potential victims. To do this, the group identifies significant events that will be widely publicized and accompanied by live broadcasts. The second step is creating a deepfake video mimicking official event video and abusing the events via embedded QR codes that lead to fraudulent websites. <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#technical-analysis">Technical analysis</a> proves these scam websites are generated using the same patterns and framework.Once the fake videos and websites are ready, the attackers distribute them using compromised accounts from popular platforms, especially YouTube. Therefore, another crucial part of the operation is procuring these compromised accounts because accounts with many subscribers increase the probability of attracting victims. In addition, fake comments also supplement the distribution of the abused event. Finally, the successful campaign results in collecting cryptocurrency wallets with fraudulently obtained crypto coins.<h6 class="text-align-justify">Search Engines</h6>We have figured out how victims are led to fake videos or hijacked accounts; it is a crucial part of the scammers’ operation because it is primarily designed to be multiplatform. The initial phase is observed mainly on desktop platforms, while the landing page is directed towards smart devices via QR codes.Most victims reach the fraudulent videos by searching for keywords related to the exploited events in popular search engines, such as “<code>spacex starship launch 4</code>“, “<code>starship flight test</code>“, and “<code>start starship</code>“. Another direct access point is searching for keywords directly on YouTube, such as “<code>eclipse 2024 totality</code>“, “<code>integrated flight test four</code>“, and “<code>spaceship</code>“. In addition to direct searches, we have observed fake or misused comments on various forums and posts on platforms X, Facebook, and Twitch. See examples below.

<h4 class="text-align-justify" id="cryptoproject-operations">CryptoProject in Scammer Operations</h4>We have named the scammer group after the framework used to generate the landing pages – CryptoCore. However, the campaigns might be the result of collaboration between several independent cybercriminal groups, possibly through subcontracting.Landing pages are created using a framework advertised on various hacker forums under the brand CryptoProject. The developers offer deployment on personal domains for approximately $100 and even showcase examples of the giveaway campaigns that we have been monitoring, as illustrated in the images below. Orders for specific pages can be placed via their dedicated Telegram bot.

Interestingly, deepfake videos and even stolen accounts or comments can be procured in a similar way. That means that all the necessary tools are available as a service. This leads to the natural question of whether the whole scam campaign can be procured via a service and the client only needs to supply crypto wallets (basically Scam-as-a-Service), or rather, this is the work of a single group potentially subcontracting parts of its campaign.Regardless, we can assert with high confidence that landing pages are created using a framework that is available as a service, presumably we could probably extend this assessment even to its parts, such as deepfake videos, hijacked accounts, and fake comments. Further research is needed to reveal more details about other links, especially on the fraudulent crypto wallets, which could rule out one of these options.<h4 class="text-align-justify" id="crypto-wallet-analysis">Crypto Wallet Analysis</h4>Over a six-month timeframe analysis, we found hundreds of crypto wallets with millions of dollars in turnover. However, it is essential to note that adding up all incoming transactions for each wallet is insufficient to determine the final value because it is necessary to deduct outgoing transactions in BTC from the same wallet. We also recorded large transactions unrelated to any giveaway campaigns, presumably representing transfers between the scammers’ wallets. Nevertheless, the wallets evidently belong to the attackers and not to a middleman. Therefore, the following statistical data on crypto wallets is not exact but provides a basic overview of the approximate range of revenues generated from the group’s illegal activities.In total, we detected 1200 crypto wallets, with the most frequently used currencies being Ethereum, Bitcoin, Tether, and Dogecoin, as shown in the graph below.

These wallets had a turnover of approximately $5,400,000. The table below summarizes the transaction details for each wallet. In absolute values, Bitcoin wallets represent the largest share of the total turnover due to Bitcoin’s high value, with Ethereum wallets coming in second. The complete list of collected crypto wallets can be found in the <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#ioc-wallets">IoC</a> section below.<table class="table"><tbody><tr><td>Wallet</td><td>Value</td></tr><tr><td>BTC</td><td>$&nbsp;&nbsp;&nbsp; 3,229,752</td></tr><tr><td>ETH</td><td>$&nbsp;&nbsp;&nbsp; 1,651,163</td></tr><tr><td>DOGE</td><td>$&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; 238,724</td></tr><tr><td>SOL</td><td>$&nbsp;&nbsp;&nbsp; &nbsp;&nbsp; 102,294</td></tr><tr><td>XRP</td><td>$&nbsp;&nbsp;&nbsp; &nbsp;&nbsp; 188,441</td></tr><tr><td>&nbsp;</td><td>$&nbsp; 5,410,377</td></tr></tbody></table><h4 class="text-align-justify" id="hijacked-yt-accounts">Hijacked YouTube Accounts</h4>Since YouTube remains the most popular video-sharing platform with billions of users worldwide, scammers actively exploit its authentication mechanisms. Previous analyses and blog posts have recorded hundreds of suspicious accounts. The most hijacked accounts can be accounted for by two cases, one with 19 million subscribers and another with nearly 12 million <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#reference">[4, 10]</a>. During our observations, accounts with 5 million subscribers were not uncommon. Such high subscriber counts allowed scammers to appear in the top 10 search results.

While the channels evade YouTube’s detections (and subsequent blocking), they are thematically adjusted to suit the current campaign’s needs. One channel might have channel names like MicroStrategy, Tesla, SpaceX, Ripple, etc. Typically, the background image, channel name, description, and alias (e.g., <code>@RippleXRP24</code>, <code>@MicroStrategys</code>) are changed, often relying on typo-squatting to confuse victims. Attackers also switch the original owner’s videos to private and upload their own content, consequently making the account look as credible as possible, even with verified status and a large subscriber base.It is evident that these are massive attacks on YouTube accounts with high subscriber counts. If scammers are not targeting a specific event, we observe several hijacked accounts daily, usually themed as MicroStrategy or XRP. However, on the day of a significant global event such as the SpaceX launch, the number of active stolen accounts can rise to dozens.Individual accounts are blocked or removed by YouTube for violating rules, but not in most cases. Moreover, many misused accounts can only be parked, and some remain active for the next promising event. Therefore, the parked accounts can be used in multiple CryptoCore campaigns before they are blocked. Victims often report that proving account ownership to YouTube is very difficult. Moreover, accounts can be blocked or permanently deleted, including all content. Given the large number of subscribers, the result is a significant loss for the victims, as they have built their profiles over many years.As mentioned in <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#modus-operandi">modus operandi</a>, the accounts are stolen through phishing or malware spread via emails. Previous studies have considered that attackers are shifting away from Gmail to other email providers, primarily using <code>email.cz</code>, <code>seznam.cz</code>, <code>post.cz</code>, and <code>aol.com</code> <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#reference">[2]</a>. One documented case involved cookie theft, giving the attacker access to the account without needing the username, password, or two-factor authentication <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#reference">[11]</a>. In addition, it is also possible that attackers purchase credentials on the dark web.<h6 class="text-align-justify">Hijacked YouTube Account Statistic</h6>We do not aim to provide a complete statistical analysis of YouTube accounts due to the limited scope of analyzed accounts. However, more than 20% of hijacked accounts in our sample had over a million subscribers. The largest shares, approximately 36%, were accounts with 100K to 500K subscribers. So, the vast majority of stolen accounts have a huge number of followers, especially when we consider that MicroStrategy’s official YouTube account has “only” 39.1K subscribers.

Such high subscriber numbers can be beneficial by boosting search results, resulting in both increased visibility as well as credibility. Regarding topics, most accounts tried to associate themselves with SpaceX events, with the second most popular being MicroStrategy which has been a CryptoCore staple for quite some time. The third significant topic is Ripple. However, we must consider noise in the statistics, as the content may change over time, and a single account can cover multiple topics. To illustrate the scale, the number of viewers for live streams of deepfake videos often reaches into the hundreds of thousands.

<h6 class="text-align-justify" id="hijacked-yt-account">Hijacked YouTube Examples</h6>We witnessed many modifications made to hijacked accounts during this research. The method of manipulation remains consistent, so we will provide one specific example of how the attackers operate and misuse the compromised accounts.The prime example involves an abused YouTube account with many subscribers (1.46M), fortunately with a happy ending. This account was compromised on May 20, 2024, and rebuilt into an “official” MicroStrategy channel, including modification of the background image and description and uploading videos from MicroStrategy’s official website. The victim’s original videos were hidden or selected as private.If someone searched for the keyword “MicroStrategy”, the hijacked account appeared second in the result list. However, the channel’s original name remained in the search list despite being renamed. The video contained a well-known deepfake video with a QR code leading to the very familiar fake page. Interestingly, one of the original posts from the victim’s YouTube channel remained on the Community tab; see the animation below. Additionally, we utilized this error to communicate with the support team, as documented in <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#online-chat-case02">Case 2: Suspicious YouTube Channel</a>. Finally, the hijacked account was terminated the next day.

In this case, we have also noticed that the victim had other social media platforms where he announced to this audience that his YouTube account had been compromised and used to spread MicroStrategy and Ripple-related spam. This indicates that the account was live long enough after being hijacked to spread multiple campaigns before YouTube took it down.After some time, the account was returned to its owner. However, the alias to the hijacked account is still active. So, the link <code>@REWARD.MS2024</code> still directs to the victim’s YouTube account.Since attackers abuse accounts with a large audience and they want to retain access to it for as long as possible, they try to hide their activity to avoid being detected by the rightful owner of the account. Whenever they end a campaign, which usually lasts a few hours, they attempt to restore the account to the previous state. Nevertheless, they are not always diligent in these efforts, and they may miss some details such as channel name or background image.A common sign of stolen accounts is the community tab, which, despite the masking of the hijacked account, contains posts from the original owners.&nbsp;<h4 class="text-align-justify" id="video-policy">Video Policy &amp; Providers’ Safeguards</h4>YouTube does define rules and policies for accounts and content visibility, but the effectiveness of its automated scam detection is insufficient. Despite the CryptoCore scam being a longstanding issue known to Google <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#reference">[2]</a>, there is no noticeable decrease in scam activities. Instead, major media events (e.g., SpaceX flight tests) are continually exploited with similar patterns that could be automatically detected. Although YouTube has mechanisms to block inappropriate content and accounts, these mechanisms often take more time and effort to respond. YouTube videos and accounts are typically blocked based on user reports, requiring substantial user intervention to trigger the blocking action. Consequently, the hijacked accounts with scam videos were not removed till a few days after the abuse event, as the figure below demonstrates.

Cloudflare sometimes displays warnings about suspicious content, but this is rare and used primarily for long-running domains. Therefore, we see small proactive activity at the infrastructure level of providers, although the landing pages are generated using the same CryptoCore framework with static artifacts that can be easily identified and blocked.

<h4 class="text-align-justify" id="abused-events">Abused Events</h4>As described above, the attackers are exploiting various events to attract as many victims as possible. We recorded five significant events during the observed period.At the beginning of January, Michael Saylor, the executive chairman of MicroStrategy, started selling company shares worth $216 million <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#reference">[12]</a>. Attackers used this event to flood the internet with fake videos claiming Michael Saylor was giving away $100,000,000. This event was continuously misused throughout 2024.Another significant peak occurred on March 14, 2024, when the SpaceX event during the SpaceX Starship integrated flight test (IFT-3) <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#reference">[13]</a> was exploited. This period saw the highest number of detections.In mid-March, a fake campaign ran after Reuters released information about a contract in which SpaceX allegedly built a network of hundreds of spy satellites <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#reference">[14]</a>.Another notable peak was on April 8, 2024, during the solar eclipse, when SpaceX’s name was once again abused in a CryptoCore campaign.The last major campaign occurred on June 6, 2024, during the SpaceX Starship integrated flight test (IFT-4) <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#reference">[15]</a>. Nearly 50 hijacked YouTube accounts were used during this several-day campaign. During this campaign, we identified 84 crypto wallets with 500 transactions with a total value of $1.413M.Additionally, there are sometimes small campaigns that misuse events of elections or tech companies. The examples below illustrate the landing pages for the WWDC24 Apple developer conference and the “giveaway” of Donald Trump.

<h4 class="text-align-justify" id="deepfake-videos">Use of Deepfake Videos</h4>CryptoCore campaigns are complementing YouTube accounts with deepfakes videos. These videos abuse official footage from well-known events, personalities, or companies. For instance, in the case of SpaceX and Elon Musk, we have observed the misuse of videos from events such as the SpaceX All Hands 2024, the Starship Flight Test, and the Starship Update from 2022. For Michael Saylor’s campaigns, the exploited videos feature titles such as “Bitcoin is Digital Energy with Michael Saylor”, “10 Rules for Life with Michael Saylor”, and “The Nature of Energy with Michael Saylor”. Other personalities targeted include Larry Fink (CEO of BlackRock), Vitalik Buterin (programmer and co-founder of Ethereum), and Bradley Garlinghouse (CEO of Ripple Labs).The compilation of deepfake videos below illustrates the <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#modus-operandi">modus operandi</a> and its common theme: a well-known personality talks about a unique chance to double your investment. The videos use fake voices and, in some cases, advanced deepfake techniques like lip-syncing. Typically, these videos are looped every 12 minutes, often preceded by, for example, a countdown for a rocket launch or the start of an online broadcast.Furthermore, some videos are pre-recorded and published as live streams. For instance, we have seen fresh accounts hosting a video that is about three hours in length, then marked as private, but later, the same content appeared as a live stream on the same account. Sometimes, we have seen captured live streams with added scam-related elements, such as a specific background or a QR code inside the video stream.During the last major crypto campaign, we noted advancements in the usage of deepfake technology. The videos now feature detailed shots of personalities with high-quality lip-syncing, which can easily deceive viewers into believing they are watching an official statement. Additionally, they use parts of the original background, such as large screens, to seamlessly display information related to the scam.Additionally, the misused personalities have published official statements against these scams but are largely ineffective in stopping them <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#reference">[16, 17]</a>.

<h4 class="text-align-justify">Fraudulent Websites Statistic</h4>The statistics of information extracted from the exposed pages come from a time window spanning from January to June 2024 (6 months). During this period, we detected 340 different domains containing scams generated through the <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#cryptoproject-operations">CryptoCore framework</a>. The graphs below show the distribution of headlines used on these fraudulent websites. In summary, the most exploited themes are MicroStrategy, SpaceX, and Tesla.

Interestingly, attackers sometimes change their wallets on fraudulent sites. It may happen when the wallets are flagged on some crypto-scam list. The graph below illustrates how wallets have been changed in two domains over time. Therefore, collecting crypto wallet information is an ongoing process that requires regular monitoring of the content on these fraudulent sites.

<h4 class="text-align-justify" id="technical-analysis">Technical Analysis</h4>We additionally analyzed the fundamental technical aspects of fake websites and the infrastructure built by the&nbsp;framework. The web design of these websites is predominantly built upon obfuscated Java Scripts. It easily facilitates the concealment of crypto wallets, constants, other features, and variables that shape the dynamically generated content. Similarly, the wallets’ QR codes are generated by another obfuscated JavaScript and stored locally in memory.

<h6 class="text-align-justify">Online Transaction Dashboard</h6>Every five seconds, random transaction numbers and wallet addresses are generated to simulate completed transactions and increase the event’s credibility.The wallet definition also includes variables determining how fake online transactions will be randomly generated. A random node is defined for each wallet, containing information about the format for a hash transaction and a recipient wallet, including the prefix and length.

Therefore, the resulting effect looks professional and legal, but the hashes and wallets are deliberately abbreviated, so they cannot be verified.

<h6 class="text-align-justify">Anti-debug Protection</h6>The JavaScript codes also employ several techniques to prevent detailed inspection of the fraudulent pages. Specific keyboard shortcuts that allow access to implementation details, such as <code>Ctrl+U</code>, <code>Ctrl+S</code>, <code>F12</code>, etc., are disabled, and a user is redirected to<code> /clarity</code> page with the CryptoCore about page.

Moreover, the pages also intercept and prohibit copy events; copying for wallet via a button is allowed only via JavaScript code. So, when the “copy address” button is clicked, a defined event is sent to the backend. The API event is structured as: <code>api/event?id=&lt;event&gt;</code>, where <code>&lt;event&gt;</code> is defined for each wallet. Finally, the wallet addresses in the JavaScript code are encrypted using a simple Base64 encoding written in reverse order.<h6 class="text-align-justify">Online Chat</h6>The online chat for communicating with the “support team” is implemented using third-party services such as <code>LiveChat</code>, <code>Tawk.to,</code> and <code>Smartsupp</code>. All three services also offer trial or free versions. On sites launched earlier, we have observed that chats are already often blocked.

Still, the chats are always functional and ready to communicate with a potential victim on newly launched sites.<h6 class="text-align-justify">Web Crawling Protection</h6>Before the desired page is rendered, attackers implement several mechanisms to prevent simple web crawling. The first mechanism involves managing cookies, which are calculated on the client side based on constants sent during the initial contact with the C2 server. The specific code for deriving the cookies is as follows:<code>document.cookie = "0x=" + toHex(slowAES.decrypt(c, 2, a, b)) + "; expires=Wed, 01 Jan 2025 22:22:22 GMT; path=/";</code>The constants <code>a</code>, <code>b</code>, and <code>c</code> are defined by the C2 server and are linked to the victim’s IP address. This allows attackers to block selected ISPs better. Additionally, sessions are non-transferable, and if the cookies do not match, the server continually sends a request with the calculation of the current and correct cookies for the given IP address. Hence, if everything matches, the server sends the requested content.The second mechanism involves checking user agents in the HTTP header. If the user agent is on a blocklist (such as <code>wget</code>, <code>curl</code>, etc.), the web server returns a <code>403 Forbidden</code> response. Additionally, there is ISP filtering, which results in a <code>404 Not Found</code> response for blocked ISPs.<h6 class="text-align-justify">Cloudflare Protection</h6>There was an interesting difference between collected domains and resolved IP addresses. We have collected a total of 340 different domains with suspicious websites but approximately 440 IP addresses. This discrepancy is due to the websites typically hosted behind dynamic reverse proxies. Therefore, we collected many IP addresses.The overwhelming majority (99%) of these proxies (IPs) are provided by Cloudflare, with only 1% observed using Akamai Technologies. The use of reverse proxies makes it very difficult to track and determine the exact location of the web servers. Additionally, reverse proxies complicate automated web crawling by requiring bot verification.

However, based on historical data from 2021, when the group did not yet use reverse proxies, we have determined that nearly 70% of the web servers were hosted in Russia and 15% in the Netherlands. These web servers were running on <code>Ubuntu </code>with the <code>nginx </code>web server.

<h6 class="text-align-justify">Tech Support Chat</h6>An integral part of professional websites and large companies is the support chat. In the case of CryptoCore, chat is implemented using third-party plugins. Previous publications have noted that the chat may be connected to a particular form of LLM <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#reference">[18]</a>.Several test communications with the purported technical support lead us towards the presumption that there are real people responding to the communication. A few examples of these interactions are shown below. Generally, the support team tries to convince you of their legitimacy. If you inquire about a transaction, you made but did not receive the promised double return, they will ask for the transaction hash or a screenshot. Unsurprisingly, no complaint resulted in a refund.Case 1: Forged Transaction ConfirmationWe created a fake screenshot showing a transfer of 0.33 BTC but with a current price of only $600. The support team explicitly questioned the current price amount. This indicates that the support team can respond to images and more complex content (such as suspicious BTC price), presumably ruling out simple LLM-based chatbots.Case 2: Suspicious YouTube ChannelIn the second case, we confronted the support team that their wallets were listed on the Crypto Scam Tracker. They responded that it was an official event by Michael Saylor, including a verified YouTube account. Our follow-up argument was that the YouTube account contained posts from another (hijacked) user. This apparent discrepancy was explained as a YouTube error, with no connection to them. A detailed story of this YouTube channel can be found in the <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#hijacked-yt-account">Hijacked YouTube Examples</a> section.Case 3: No Transactions on WalletsWe confronted the support team that their transaction dashboard showed numerous transactions, but we needed help finding a transaction on the blockchain. Their response was rather unconvincing. Additionally, they stated there was no way to verify that our investment would be returned.Case 4: Forged Transaction System DashboardWe again created a fake screenshot showing a BTC transfer and a fake dashboard with the same transaction ID, currency, and amount of BTC. We have asked why we did not receive the payment when the transaction appeared on the dashboard. The brief response claimed the transaction had been paid out and could not be ours.

<h4 class="text-align-justify" id="detections">Detections</h4>Detections related to giveaway scams are focused on the fraudulent pages on desktop and smart devices (mobile smart phones). However, scammers encourage victims to use a smart device and scan a QR code to avoid antivirus solutions because more than 50% of smart devices have no protection <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#reference">[19]</a>. Our telemetry data shows that the hit ratio for CryptoCore detections on desktop and smart platforms is 2:5, which indicates a rather significant success in redirecting victims to generally less protected platforms.Our telemetry also demonstrates a correlation between the detection hits and events abused by the scam groups. In total, we can identify five significant events in the crypto world that have a demonstrable connection to the CryptoCore detections. The details of the abused events are summarized in the section <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#abused-events">Abused Events</a>.

The countries that are the most affected by CryptoCore risk are the United States, the United Kingdom, Brazil, and Germany. There is also a noticeable difference between users of smart devices and desktop computers. On smart devices, we detected the most scams associated with the IFT-3 event, while on desktop devices, the event related to the solar eclipse – seems to have attracted a larger audience.

<h4 class="text-align-justify" id="conclusion">Conclusion</h4>The giveaway scam campaign spread by the scam group CryptoCore is a sophisticated operation that exploits the popularity of cryptocurrencies and the trust of users in well-known personalities and events. The scammers use deepfake technology, hijacked YouTube accounts, and professionally designed websites to deceive victims into sending their cryptocurrencies to the scammers’ wallets.CryptoCore has been operating on a large scale for at least five years. The platforms, e.g., YouTube and Cloudflare, block giveaway scams only sporadically or with significant delays, despite the <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#modus-operandi">modus operandi</a> remaining unchanged for years. Moreover, we continue to observe several newly hijacked YouTube accounts for each campaign that represent a substantial risk in conjunction with parked accounts from previous campaigns. Additionally, we have documented several cases of hacked accounts where owners had to recover the channels built for many years. Statistics show that nearly 65% of accounts compromised by CryptoCore have over 100k followers, and 20% have over a million subscribers. Therefore, we strongly recommend all YouTube account owners take additional security precautions such as using 2FA and strong passwords, being aware of potential phishing campaigns, regularly checking account activity to detect unauthorized access, ensuring account recovery options (such as another email or phone number), and using reputable antivirus and security software to protect devices from malware that could compromise the accounts.Although we primarily focused on YouTube, we have seen similar scam attacks on other platforms, evidently from the same scam group. Previous studies indicate that the group’s activity is extensive; during our six-month observation, we estimated nearly $5.4 million in stolen crypto coins. Moreover, if attackers exploit the right event, they can gain almost $1.5 million within a few days. However, this suggests the group’s annual profit must be significantly higher.Tracing the whole attack vector is complicated because scammers split the vector across two platforms. For that reason, redirecting victims to smart devices increases the probability that fraudulent sites will not be detected by antivirus software since many people do not protect their smart devices. Consequently, we observe the highest incidence of fake sites just on smart devices. Everything indicates that such attacks will continue, with the group seeking attractive events to exploit until the targeted platforms effectively protect their users and visitors.Note that we named the scam group as the used scam framework CryptoCore; however, based on the analysis CryptoCore-associated campaigns, the giveaway scam is a complex scam project probably delegated to other paid services, often illegal. Moreover, the deepfake videos have continuously improved over the observed year. In terms of directions for future research, further work could analyze the collected crypto wallets.Users must stay informed about these scam risks. As the cryptocurrency landscape evolves, so will the scams that exploit it. Users should always be cautious if an offer seems too good; no one gives anything for free. Users should also be wary of YouTube accounts with many subscribers but suspiciously low activity and inconsistent content. Finally, having a good antivirus program installed on smart devices is essential. Therefore, continuous research and vigilance are necessary to protect potential victims and safely navigate the evolving cryptocurrency scene. Remember, if it sounds too good to be true, it probably is. Stay safe!If this type of scam has compromised <a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/#ioc-yt">your accounts</a>, do not hesitate to <a href="https://web.archive.org/web/20241216045951/mailto:ti@avast.com">contact us</a> and share your information and experiences. By doing so, you help improve protection against attackers and limit the reach of fraudsters.<h4 class="text-align-justify">IoC</h4><h6 class="text-align-justify" id="ioc-wallets">Crypto Scam Wallets</h6><a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/wp-content/uploads/sites/2/2024/07/cc-cryptowallets.xlsx" id="wp-block-file--media-0d9ae82d-f956-4d86-b0f3-f13a762a23df">cc-cryptowallets</a><a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/wp-content/uploads/sites/2/2024/07/cc-cryptowallets.xlsx">Download</a><h6 class="text-align-justify" id="ioc-yt">Hijacked YouTube Accounts</h6>The <code>cc-yt-accounts</code> list summarizes the most active YouTube accounts abused in CryptoCore campaigns, and the “Status” column describes each one’s state. It is a snapshot of August 7, 2024.The “active” state indicates that the account contains artifacts typical for hijacking (background image, account name, etc.), but without scam videos. So, we cannot determine whether these accounts are still under the control of bad actors or have been returned to their original owners and have not been rolled back to their original state yet.<a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/wp-content/uploads/sites/2/2024/08/cc-yt-accounts.xlsx" id="wp-block-file--media-a3edb374-5c44-4cf4-937e-a667d64d398d">cc-yt-accounts</a><a href="https://web.archive.org/web/20241216045951/https://decoded.avast.io/wp-content/uploads/sites/2/2024/08/cc-yt-accounts.xlsx">Download</a><h4 class="text-align-justify" id="reference">Reference</h4>[1]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href="https://web.archive.org/web/20241216045951/https://www.bbc.com/news/technology-46097853">Twitter: Fake Elon Musk scam spreads after accounts hacked</a> [2]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href="https://web.archive.org/web/20241216045951/https://blog.google/threat-analysis-group/phishing-campaign-targets-youtube-creators-cookie-theft-malware">Phishing campaign targets YouTube creators with cookie theft malware</a> [3]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href="https://web.archive.org/web/20241216045951/https://therecord.media/scammers-hijack-youtube-channels">Scammers hijack YouTube channels to promote Elon Musk-themed crypto schemes</a> [4]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href="https://web.archive.org/web/20241216045951/https://arxiv.org/pdf/2405.09757">Give and Take: An End-To-End Investigation of Giveaway Scam Conversion Rates</a> [5]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href="https://web.archive.org/web/20241216045951/https://www.akamai.com/blog/security-research/crypto-giveaway-scams-are-still-successful#analysis">Technical analysis from one of the scam kits distributed on the dark web</a> [6]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href="https://web.archive.org/web/20241216045951/https://www.bitdefender.com/blog/hotforsecurity/beware-of-scams-elon-musk-is-not-giving-away-bitcoin-on-twitter">Beware of scams! Elon Musk is not giving away bitcoin on Twitter</a> [7]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href="https://web.archive.org/web/20241216045951/https://www.bitdefender.com/blog/hotforsecurity/fake-elon-musk-crypto-giveaway-scam-campaigns-run-rampant-on-tiktok">Fake ‘Elon Musk’ Crypto Giveaway Scam Campaigns Run Rampant on TikTok</a> [8]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href="https://web.archive.org/web/20241216045951/https://www.bleepingcomputer.com/news/security/verified-twitter-accounts-hacked-in-580k-elon-musk-crypto-scam">Verified Twitter accounts hacked in $580k ‘Elon Musk’ crypto scam</a> [9]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href="https://web.archive.org/web/20241216045951/https://www.wired.com/story/youtube-bitcoin-scam-account-hijacking-google-phishing">How Hackers Hijacked Thousands of High-Profile YouTube Accounts</a> [10]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href="https://web.archive.org/web/20241216045951/https://www.bitdefender.com/blog/labs/stream-jacking-2-0-deep-fakes-power-account-takeovers-on-youtube-to-maximize-crypto-doubling-scams">Deep fakes power account takeovers on YouTube to maximize crypto-doubling scams</a> [11]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href="https://web.archive.org/web/20241216045951/https://www.kaspersky.com/blog/youtubers-takeovers/48375">Hacking YouTube channels with stolen cookies</a> [12]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href="https://web.archive.org/web/20241216045951/https://www.coindesk.com/business/2024/01/03/michael-saylor-commences-plan-to-sell-216m-worth-of-microstrategy-stock-options/?utm_medium=referral&amp;utm_source=rss&amp;utm_campaign=headlines">Michael Saylor Commences Plan to Sell $216M Worth of MicroStrategy Shares</a> [13]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href="https://web.archive.org/web/20241216045951/https://en.wikipedia.org/wiki/SpaceX_Starship_integrated_flight_test_3">SpaceX Starship integrated flight test 3</a> [14]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href="https://web.archive.org/web/20241216045951/https://www.reuters.com/technology/space/musks-spacex-is-building-spy-satellite-network-us-intelligence-agency-sources-2024-03-16">Exclusive: Musk’s SpaceX is building spy satellite network for US intelligence agency, sources say</a> [15]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href="https://web.archive.org/web/20241216045951/https://en.wikipedia.org/wiki/SpaceX_Starship_integrated_flight_test_4">SpaceX Starship integrated flight test 4</a> [16]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href="https://web.archive.org/web/20241216045951/https://x.com/elonmusk/status/1529484675269414912">X – Elon Musk status</a> [17]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href="https://web.archive.org/web/20241216045951/https://x.com/saylor/status/1746298365036343477">X – Saylor status</a> [18]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href="https://web.archive.org/web/20241216045951/https://www.bitdefender.com/blog/labs/a-deep-dive-into-stream-jacking-attacks-on-youtube-and-why-theyre-so-popular">A Deep Dive into Stream-Jacking Attacks on YouTube and Why They’re So Popular</a> [19]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href="https://web.archive.org/web/20241216045951/https://www.security.org/antivirus/antivirus-consumer-report-annual/#usage">Antivirus in the Age of Evolving Threats: 2024 Antivirus Market Report</a>

If it sounds too good to be true, it probably is.

CryptoCore: Unmasking the Sophisticated Cryptocurrency Scam Operations

One of the biggest online threats facing people of all ages, but especially teenagers and young adults, is cyberbullying. Cyberbullying is a growing problem in schools due to the anonymous nature of the internet and the speed in which rumors, threats, and embarrassing photos can be disseminated. Our nonprofit partner, the National Cybersecurity Alliance (NCA), launched a campaign to help parents and educators understand what to do about cyberbullying, and I am proud to be a part of it.Last week, I joined NCA and a panel of experts on a webinar to help raise awareness about cyberbullying, while sharing tips for preventing and reporting it with nearly 200 attendees.&nbsp;What is Cyberbullying?&nbsp;We began by defining cyberbullying. The term itself is subjective and changes as technologies change, but the government defines bullying as unwanted, aggressive behavior that involves a real or perceived power imbalance (1). Online, that can mean anything from private photos being shared without one’s permission to threatening or hurtful messages. Bullies can even impersonate their victim with fake accounts, stealing their social identity to cause more harm.&nbsp;Cyberbullying Tips&nbsp;With children starting their online lives earlier and earlier, technology has enabled bullying on a scale today that didn’t exist generations ago. It’s vital to keep that in mind when you or your children are posting or browsing. Here are a few tips:&nbsp;<ol><li>Keep Some Secrets.&nbsp;You might log into social media for an escape, or to post that cute picture from the hike you went on. But be careful about who can access details of your children’s interests, habits, or even employment to reduce their exposure to bullies they don’t know. Set your privacy settings on your Instagram and Facebook accounts to ‘private’ so that only people know can see your information, not the general public.&nbsp;</li><li>Avoid Escalating the Situation. Responding with hostility often provokes bullies, most of whom thrive on the reaction of their victims. If you or your child receives unwanted emails or messages, consider blocking the sender and reporting it on social media to try and stop the problem immediately. You should also document the bullying, keeping a record of online activities and relevant dates and times.&nbsp;</li><li>Discuss Online Safety with Your Children.&nbsp;As your children begin to spend time online, they are likely to identify social media influencers that they admire and might want to emulate. This may&nbsp;lead to them&nbsp;accepting any and all followers on social media and&nbsp;to over-sharing&nbsp;personal images and videos and sensitive information, which will dramatically increase their risk of cyberbullying. For help beginning these conversations with your children, use our free resource <a href="https://thesmarttalk.org/">The Smart Talk</a> ,which helps families set digital safety ground rules together.&nbsp;&nbsp;</li><li>Report Cyberbullying to the Authorities.&nbsp;If you’ve taken measures to stop the problem, but it’s continuing or even escalating, you should reach out to get help. Many school districts have online reporting options, while clubs, sports teams, places of worship, and other extracurricular groups should have someone who can step in and help. If this doesn’t address the problem, or you fear for the victim’s safety, it’s time to contact local law enforcement. While there is a distinction between free speech and punishable offenses, law enforcement officials can help sort out the legal implications and can help let the bully know that you are serious.</li></ol>For more tips, check out NCA’s new <a href="https://staysafeonline.org/online-safety-privacy-basics/cyberbullying/">Cyberbullying Awareness Toolkit</a> or watch the webinar recap here:&nbsp; &nbsp;

Cyberbullying is a serious issue, and we can work together to learn how to identify, prevent, and stop it to make the internet a kinder place for our kids.&nbsp;

NortonLifeLock and the National Cybersecurity Alliance help parents and educators address cyberbullying

How to Help Protect Kids From Cyberbullying

Corporate Responsibility 

November was a busy month at Gen (formerly NortonLifeLock). In addition to <a href="https://newsroom.gendigital.com/2022-11-07-Introducing-Gen-The-Company-to-Power-Digital-Freedom">announcing our new company name</a>, and promoting employee giving as we approach the holiday season, we launched the Gen Giving Hub. This online platform, hosted by Benevity, provides employees with a seamless way to find volunteering, giving, and educational opportunities. To celebrate this launch, Gen gave each employee $50 in “seeding,” which can be donated to a charity of their choice. Since our mid-November launch, 57% of active users have already redeemed their seeding!Even more exciting was the incredible employee generosity we witnessed last week on Giving Tuesday. <a href="https://www.givingtuesday.org/">Giving Tuesday</a>, which was on November 29, 2022, was originally started 10 years ago at the 92nd Y in New York City, is a global movement dedicated to promoting radical philanthropy in all its forms. It has since grown into its own nonprofit that is successful in raising millions of dollars each year for charitable causes around the world.Last year, the NortonLifeLock team raised more than $250,000 in just one day. This year, as Gen we more than doubled that! With an unprecedented employee match donation of 3:1, 694 Gen employees donated $140,910, resulting in $509,992 in total donations to 674 different causes.Mohanakrishnan G, a Gen principal VoC analyst based in Chennai, India, set up a giving opportunity to pool donations from colleagues for Project WINGS. Project WINGS supports 70 orphaned children at the Chennai Good Life Centre by providing communications, computer, fitness, and other life and work skills training. In addition to donating, Mohanakrishnan also serves as a Project Wings mentor. He sees the alignment between Project WINGS and Gen’s goal to enable and motivate the next generation to become their best selves. Regarding the 3:1 donation match, Mohanakrishnan said, “That was a fantastic thing and encourages our employees to contribute towards a community or cause. I appreciate the efforts and want to thank the entire CR Team, my colleagues for donating to such a wonderful cause, and all the employees who contributed.”Michal Trs has organized Movember, an annual event involving the growing of moustaches during the month of November to raise awareness of men's health issues, such as prostate cancer, testicular cancer, and men's suicide, at Avast (now Gen) for about eight years. Having lost his mother to cancer at a young age, Michal is motivated to do what he can to prevent others from experiencing a similar loss. “I’m really grateful to the company leadership and our colleagues around the globe for supporting this fundraiser each year,” Michal said. Within the Czech Republic, Avast (now Gen) has been recognized by Nadační fond Muži proti rakovině (Men Against Cancer Foundation) as the most generous company team for several years running, and many employees look forward to the tradition each year. Erin Gallegos is one of those employees. She has helped to coordinate the annual internal campaign, which over the years has involved moustache stickers, posters, Zoom backgrounds, men’s health events and photo shoots to raise awareness and funds. “Movember is a fantastic and lighthearted way to get people talking about really difficult and personal subjects, and to raise money for underfunded causes. It was very supportive of Gen to provide a 3:1 match to support the cause,” Erin said.In the U.S., Jess Monney, VP of Corporate Brand, Marketing &amp; Communications, made Giving Tuesday a family affair. She chose to give to the Alzheimer’s Association, Tunnel to Towers Foundation, and Folsom Zoo Sanctuary because the organizations are close to the hearts of her family members. Jess used these donations as early Christmas presents for her family, saying, “For me the holiday season is about looking back and forward. I donated to these causes because they inspire my family throughout the year. With three kids under four, we are at the Zoo most weekends and being able to donate to such local causes within my hometown felt so personal. The 3:1 match really maximized my impact and I was proud to share with my family members that a donation of that scale was made in their name.”Giving Tuesday may have passed, but giving is always in season at Gen. In fact, we now call our corporate responsibility program Giving@Gen. Next up, we’ll be providing corporate grants as part of our holiday giving efforts focused on alleviating food insecurity. Several of the organizations we support through holiday giving, also received donations on Giving Tuesday.We’re excited to continue to utilize the Gen Giving Hub to help enable our employees to support the causes that mean the most to them. I encourage you to get involved in your community! For ideas on donating, volunteering, and showing kindness throughout the year, visit <a href="https://www.givingtuesday.org/givingeverytuesday?sortField=year&amp;sortDir=-1&amp;limit=8&amp;page=1">GivingTuesday.org</a> today.

The company doubles its donations and impact from 2021

Giving Tuesday Highlights Gen's Culture of Giving

This week, the environmental not-for-profit <a href="https://www.cdp.net/en">CDP</a> has recognized Gen for the transparency and thoroughness of our corporate sustainability program, awarding us the high score of ‘B’ on its latest assessment of thousands of companies and their progress on climate.&nbsp;&nbsp;This year’s report marks the first time Gen is disclosing its environmental program to CDP as a new company, and to receive this recognition during a time of transition speaks to the consistency with which we empower our customers, employees, suppliers, and stakeholders to take action on the environment.&nbsp;&nbsp;Reporting through CDP allows us to publicly detail the ways our company addresses climate change, its impact on our business, how climate accountability fits into our overall management structure, and how we engage our communities on the issue. The past fiscal year saw Gen take meaningful steps in each of these areas, focusing on efforts that are business-aligned and those with tangible impacts. These include:&nbsp;&nbsp;<ul><li>Conducting a high-level risk assessment of climate change’s impacts on our business objectives&nbsp;</li><li>Launching a sustainable home improvement grant program, which provides up to $500 per year to employees looking to fund green home projects&nbsp;</li><li>Establishing a baseline year for greenhouse gas (GHG) emissions and continuing to measure progress against this benchmark&nbsp;</li><li>Reducing GHG emissions in part by optimizing our facilities footprint and consolidating office space&nbsp;</li><li>Completing a life cycle assessment of our physical products and their environmental impacts&nbsp;</li><li>Analyzing what percentage of our suppliers have set ESG goals, including those on climate&nbsp;</li></ul>CDP represents more than 680 investors with more than $130 trillion in assets and assesses the depth and quality of the climate change related information that companies disclose to investors and the global marketplace. Companies complete an annual questionnaire, which CDP then scores based on companies’ awareness of environmental issues, their management methods, and progress towards environmental leadership. This scoring process is widely recognized as the gold standard of climate disclosure.&nbsp;&nbsp;We're proud to be among the more than 18,700 companies around the world that reported through CDP this year.&nbsp;&nbsp;

The company’s sustainability efforts earn global recognition

Gen is Recognized for Climate Disclosure on 2022 CDP Report

NortonLifeLock, a leading Cyber Safety brand and part of Gen, has once again been listed on the Dow Joes Sustainability Index (DJSI), celebrating the Company’s environmental, social, and governance (ESG) achievements on both the World and North America lists. It received its highest sustainability score, earning a score of 51 and ranking in the 97th percentile in the software category.&nbsp;“We are honored the Dow Jones Sustainability Index has again recognized our corporate citizenship efforts,” said Kim Allman, Head of Corporate Responsibility at Gen. “Our commitment to making a positive impact in the lives of our consumers, employees, and communities has never been stronger, and we are eager to continue to model social responsibility and accountability across our business.”&nbsp;&nbsp;The DJSI leverages a Corporate Sustainability Assessment to measure the top 10% of the largest 2,500 companies in the S&amp;P Global Broad Market Index against long-term economic, environmental, and social criteria. Companies receive a score out of 100 based on global ESG practices, comparing numerous, varied industries on both financial and industry-specific criteria.&nbsp;In this year's analysis, impactful ESG activities contributed to its high rankling, with highlights including:&nbsp;<ul><li>Philanthropy: We donated products to more than 9,300 nonprofits this year, from national organizations to local libraries, helping them keep their data safe and secure. These <a href="https://investor.gendigital.com/esg/default.aspx">social responsibility efforts</a>, along with our employee donation matching and volunteer programs, earned us a score of 44 in the social category, an increase of two points from 2021.&nbsp; &nbsp;</li><li>Environmental sustainability: We received 44 out of 100 in the environment category, a score that no doubt reflects reporting in alignment with the Task Force on Climate-related Financial Disclosures, climate risk assessment, and 39% Scope 1 and 2 greenhouse gas emissions reduction over the past fiscal year.&nbsp;</li><li>Corporate Governance: We continue to disclose data on the racial and gender makeup of both our Board of Directors and our broader employee base. This transparency, along with our Codes of Conduct for our Company, our suppliers, and additional policies, was awarded a score of 62, an increase of two points from 2021.&nbsp;</li></ul>To learn more about our commitments and progress, read the company's <a href="https://investor.gendigital.com/esg/default.aspx">latest ESG report</a>.

Receiving the highest score yet on the annual list of the world’s most sustainable businesses

Gen Named to the Dow Jones Sustainability Index 2022 

Safer Internet Week, formerly Safer Internet Day,&nbsp; is celebrated each year to promote safer and more responsible use of online technology. This&nbsp;Safer Internet Week&nbsp;hear from World Association of Girl Guides and Girl Scouts Leaders on the&nbsp;<a href="https://www.wagggs.org/en/what-we-do/surf-smart-20/">Surf Smart 2.0 badge</a>, created in partnership with Norton.&nbsp;This unique resource helps empower a generation of girls and young women with the knowledge and skills to protect themselves and others online.

Norton and World Association of Girl Guides and Girl Scouts Help Make A Safer Internet