Loading threat actor…
CryptoChameleon, also tracked as UNC5356, is a financially motivated phishing threat cluster associated with advanced, mobile-oriented credential-harvesting operations. The actor is known for reproducing sign-in experiences for cryptocurrency exchanges, password managers, single sign-on providers, email services, and some government organizations, and for combining email, SMS, and voice-based social engineering to increase conversion and evade simple defenses. Reporting also links portions of COINBAIT activity to UNC5356 and notes overlap or loose alignment in tradecraft with clusters such as Scattered Spider and PoisonSeed; some reporting further places CryptoChameleon adjacent to the SLH and Crimson Collective ecosystem, though those broader relationships are less definitive than the UNC5356 aliasing. The group has repeatedly targeted the cryptocurrency community and related platforms, including campaigns against users of major exchanges and wallet services. It has also impersonated LastPass in multiple campaigns during 2024 through 2026, including lures abusing inheritance or emergency-access themes and maintenance or backup pretexts to steal master passwords and passkeys. In some cases, operators followed phishing emails with phone calls impersonating support personnel, demonstrating coordinated vishing-enabled credential theft. Campaigns have also targeted credentials and authentication material for services such as Okta, Gmail, iCloud, and Outlook. CryptoChameleon’s operations are characterized by high-end social engineering rather than malware deployment. Observed collection objectives include credentials, MFA codes, password-reset links, passkeys, session-related authentication material, and in some cases identity documents. The actor is associated with SMS phishing and phone phishing, and its phishing kits are described as MFA-resistant, enabling theft of information entered during legitimate authentication workflows. The group’s tradecraft aligns with credential theft, session abuse, and data exfiltration from compromised accounts, especially where access to password managers or crypto-related accounts can be monetized quickly. The actor’s victimology spans cryptocurrency users and platforms, financial institutions, enterprise users, healthcare and government-related targets, and organizations using cloud identity and password-management services. High-confidence reporting supports a dominant financial motivation centered on theft of account access and downstream monetization.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
3 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mobile-focused phishing kit supporting email, SMS, and voice phishing against cryptocurrency, identity, email, password-manager, and government targets; collects credentials, authentication codes, reset links, and sometimes identity documents.
Group associated with SMS and phone phishing; linked in the report to activity around the COINBAIT phishing kit (crypto-exchange credential theft).
Financially motivated cluster assessed to overlap with activity involving the CoinBait phishing kit (credential-harvesting kit masquerading as a cryptocurrency exchange), reportedly accelerated by AI code generation tools.
Financially motivated cluster linked to aspects of COINBAIT activity (AI-generated phishing kit masquerading as a cryptocurrency exchange for credential harvesting).
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.