Dynamic Duo: Duolingo Mascot Death Scams Report

This report describes how threat actors rapidly registered at least 13 domains and launched multiple scams following a viral announcement about Duolingo’s mascot, including fraudulent cryptocurrency tokens, pump-and-dump schemes, imitation mascots to avoid detection, fake apparel stores, and a Chrome extension that could harbor credential-stealing malware; the document highlights domain timelines, social account rebranding for credibility, and recommended mitigations such as continuous brand monitoring and avoiding installs from newly-registered sites.