Scam Alert

[Arrafi Ahmed]

Scammer named "kerry_wallac" contacted me on fiverr, and shared this malicious project, which has some encrypted code to steal personal info from device:

https://bitbucket.org/madyson99/web3_demo

details about similar scam: https://shorturl.at/6Ns3t

[Andy Heinzer · Accepted solution]

Hi everyone,

Thank you all for the previous reports of malicious repos on Bitbucket Cloud.  We have recently changed our process for reporting on these.   Going forward, please send an email to abuse@atlassian.com in order to report such violations of our terms of service.

Someone from our abuse team will review these and respond as needed.

Thanks again,

Andy

[Arpan Dutta]

I also have received a shady repo to check out: 

https://bitbucket.org/crypto-oasis-socifi-multi/crypto-oasis-socifi-multi/src/main/

I am pretty sure this is a scam as well, can this be reviewed as well?

[Andy Heinzer]

Thanks for reporting it to us.  The repo has been suspended.

[Arpan Dutta]

Thank you!

[kaptainkool]

Hi,

Not sure if this repo is also malicious. I am probably too dumb to find anything. Please one of you experts weigh in.

URL: https://bitbucket.org/auctionwave_webplatform/auctionwave/src/ 

Thanks!

[Per Obiora]

I received the same repo a few days ago, in yours the malicious code was removed from the file where i found it last time, but since it's the same code-project, i'd say its better not to not run it..

[Andy Heinzer]

That repo has been suspended.

[Jim Bit]

From a post job i received this repo: https://bitbucket.org/finance_hub/stake_manager_ui/src/master/  can someone check if this is a scam..

[Per Obiora]

Don't run it on your local machine. Just took a look at it, and i'm certain it is a scam designed to steal your information related to your crypto wallets, and in fact even create transaction without your knowledge

[Jim Bit]

Thank you! 

[Andy Heinzer]

That repo has been suspended.  Thanks for reporting it to us.

[Andy Heinzer]

Thanks for reporting it to us, the repo has been suspended.

[Per Obiora]

Same here.. https://bitbucket.org/auctionwavewebplatform/auctionwave/src/main/

Someone on fiverr asked me to check out his project. Found lot's of obfuscated code in the root tailwind.config.js file. Crazy. Deobfuscated a bunch, and he's been trying to steal crypto wallet keys, login keys from keychain & my browser along with some more information. 

and send it to "http://185.153.182.241:1224/uploads " , "http://185.153.182.241:1224/client/10/100 ", "http://185.153.182.241:1224/pdown " . 

pretty crazy scam that i haven't come across yet... 

[Andy Heinzer]

Hi @Samuel 

Thanks for reporting it.  The repo has been taken down.

[Samuel]

Hi,

I think this is the same people, someone contacted me onn fiverr with the username "smith54069" and share a project with the same name in bitbucket. here's  the link to that repository https://bitbucket.org/tommy06151/web_pro/src/master/

[Andy Heinzer]

Hi @Arrafi Ahmed 

Thank you for reporting this repo to us.  Our team has reviewed this repo and taken it down.