Samfw.com Scam - Fraud & Trojan RAT Malware : SamFWTool Theft (XMR)

[craftyart1010]

Samfw scam is still active and the scammer is continuing to search for more victims. Once again case has been reported to the FBI Internet Crime Complaint Center (IC3).  

The individual involved (Tung tata) is using a “tool” to scam people, and the tool has already been flagged as malware by Malwarebytes. He appeared online on a forum but stopped responding !
We need to raise awareness to help stop this scam. Do not trust paid promotions, “safe” claims, or paid reviews about this tool those fake.  

If you encounter or already interacted with Samfw or Tung tata’s tool, consider reporting it through the proper channels and share your experience to warn others. This scammer is based in Vietnam.

They are using sophisticated methods to connect to your device and steal credentials, accounts, and wallet funds. Please take this seriously and protect yourselves. Also do not believe Trustpilot reviews. Scammer tungtata buys them to fake it. He also keeps buying blog reviews and posting reviews to show his tool working without issue and that there is no malware inside. This is SEO work done by them to lie to the community.

Do not download, install, or run any software from samfw.com!

[marto25]

We've been following this thread since it opened.

The SamFW case is well-documented at this point — Trojan.Dropper confirmed by Malwarebytes, fake timestamp set to 2097, sandbox evasion by design, version 5.4 pulled immediately after the theft.

We wrote a full breakdown — not about who is guilty, but about the opsec failure that made this possible in the first place. Because the real issue is not this specific tool. It is running any software on a machine that holds an active wallet.

Full article: https://matomba.substack.com/p/one-zip-file-one-empty-wallet-why

One environment for tools. One environment for assets. Never the same machine.

[craftyart1010]

We've been following this thread since it opened.

The SamFW case is well-documented at this point — Trojan.Dropper confirmed by Malwarebytes, fake timestamp set to 2097, sandbox evasion by design, version 5.4 pulled immediately after the theft.

We wrote a full breakdown — not about who is guilty, but about the opsec failure that made this possible in the first place. Because the real issue is not this specific tool. It is running any software on a machine that holds an active wallet.

Full article: https://matomba.substack.com/p/one-zip-file-one-empty-wallet-why

One environment for tools. One environment for assets. Never the same machine.

Thank you so much for all your efforts.

7955375aa728bcd66fd0778674cd279d8bb911bf0ff553bc09c7a5e05aebcdee

A small donation sent to support a helping community and help raise awareness about this samfwscam.

Everyone please don’t underestimate it this is a highly sophisticated, smart scam, and right now everyone is at risk.

I’m offering a donation to people who help spread the warning about samfw and make this samfwfrpscam more public so that no one else has to get scammed like I did.

So far, I’ve warned many people about the scam and helped them understand the risks. I’ve also guided them through uninstalling the samfw malicious software, and recommended formatting their computers and switching to Ubuntu or Linux Mint.

[xmrbro]

Hello, I came across your topic by chance and I sincerely sympathize with your loss. I hope you find peace and are able to overcome it. The case is very complex and important, which is why I wrote a detailed post on a Tor forum with the goal of warning other people and protecting them. Since I am also a German speaker, I translated it and posted it in the German-speaking community on BT.

https://bitcointalk.org/index.php?topic=5589494.msg66981449