Fake AI Tutorials Trick Investors Into Deploying Malicious Contracts

The campaign relied on nine nearly identical YouTube videos featuring AI-generated hosts that promised viewers a path to automated profit using Anthropic’s Claude. Rather than utilizing standard phishing links or suspicious wallet approvals, the operators directed victims to fraudulent compilers that mimicked the popular Remix development environment. Victims unknowingly deployed malicious code that remained hidden behind a clean interface, believing they were setting up their own trading tools.

Once a contract’s balance exceeded 0.05 ETH, it was programmed to automatically transfer the funds to attacker-controlled addresses whenever the user attempted to start or withdraw from the bot. Because the victims initiated the deployment and funding transactions themselves, standard security measures and wallet protections failed to flag the activity as unauthorized. TRM Labs noted that the median loss per victim reached 1 ETH, with the stolen assets eventually funneled through six collection points. This method highlights a shift in cybercrime, where attackers manipulate the deployment process itself to bypass traditional blocklists and phishing defenses.