This report serves as a warning regarding a large-scale fraudulent scheme associated with the Mythstorm project. Threat actors have created phishing sites that visually and contextually mimic the official website of the legitimate game RIFTSTORM, developed by the Singapore-based company Mythic Alliance Pte. Ltd. (Confiction Labs), using stolen images and logos.

According to the report's author, the scheme's organizers, operating under the names "Mythic Protocol" or "Mythstorm Team", lure victims through fake job postings for chat or game moderators, promising a weekly salary of $500 to $600. This offer is inherently fraudulent, as the described duties are typically performed by automated algorithms and do not require costly manual labor.

During the "hiring" process, candidates are instructed to download the installer file MythInstaller_1.0.12.0_x64.msix (Virus Total). According to the author, this file contains malware designed to steal cryptocurrency. This is evidenced by the program immediately prompting for information regarding the presence of user wallets on the Solana or Ethereum networks.

The scheme is actively promoted through compromised accounts on the social network X. Furthermore, the report notes that AI-powered bots are heavily utilized on the scammers official Discord server to simulate activity. These bots post pre-written messages but are unable to engage in meaningful dialogue when a real user attempts to interact.

Users are strongly advised against downloading any Mythstorm software or connecting cryptocurrency wallets through their platforms. If the installer has already been executed, it is crucial to immediately disconnect the computer from the internet, avoid accessing any wallets from the compromised device, transfer funds using a clean device, revoke wallet permissions, and change all affected passwords.