A pseudonymous on-chain investigator says he's unraveling a malicious scheme that's using hacked accounts on the social media platform X to promote a fake memecoin.

ZachXBT says the cybercriminal stole the credentials of high-profile X accounts by sending phishing emails that impersonated the X team.

The emails appear as a notice of policy and guideline violations from X to create a sense of urgency and get the recipients to click a malicious link.

"A threat actor has stolen ~$500K over the past month by compromising 15+ X accounts (Kick, Cursor, Alex Blania, The Arena, Brett, etc).

Each of the 15 ATOs were directly connected by mapping out the deployer address for each scam.

The attacker bridged back and forth between Solana and Ethereum in an attempt to obfuscate the funding source."

According to smart contract platform Neutron, the bad actor sent fake copyright infringement emails that told the targeted X users to reset their password and two-factor authentication (2FA) by visiting what turned out to be a phishing site.

Once the X account is compromised, the attacker logs out all sessions, changes security settings and then controls posting access to share malicious links that promote a scam token.

Says ZachXBT about security measures,