New Phishing Kit Leverages SMS, Voice Calls to Target Cryptocurrency Users

Lookout observed a phishing kit dubbed CryptoChameleon that builds realistic SSO pages to harvest credentials, OTPs, and identity documents from primarily mobile users — including employees of the FCC and customers of major crypto platforms — using SMS/voice lures, CAPTCHA gating to evade automated detection, and real-time interception of MFA codes; the report also contextualizes this activity alongside PhaaS offerings like LabHost.