Samfw.com Scam - Fraud & Trojan RAT Malware : SamFWTool Theft (XMR)

[craftyart1010]

Samfw scam is still active and the scammer is continuing to search for more victims. Once again case has been reported to the FBI Internet Crime Complaint Center (IC3).  

The individual involved (Tung tata) is using a “tool” to scam people, and the tool has already been flagged as malware by Malwarebytes. He appeared online on a forum but stopped responding !
We need to raise awareness to help stop this scam. Do not trust paid promotions, “safe” claims, or paid reviews about this tool those fake.  

If you encounter or already interacted with Samfw or Tung tata’s tool, consider reporting it through the proper channels and share your experience to warn others. This scammer is based in Vietnam.

They are using sophisticated methods to connect to your device and steal credentials, accounts, and wallet funds. Please take this seriously and protect yourselves. Also do not believe Trustpilot reviews. Scammer tungtata buys them to fake it. He also keeps buying blog reviews and posting reviews to show his tool working without issue and that there is no malware inside. This is SEO work done by them to lie to the community.

Do not download, install, or run any software from samfw.com!

[marto25]

We've been following this thread since it opened.

The SamFW case is well-documented at this point — Trojan.Dropper confirmed by Malwarebytes, fake timestamp set to 2097, sandbox evasion by design, version 5.4 pulled immediately after the theft.

We wrote a full breakdown — not about who is guilty, but about the opsec failure that made this possible in the first place. Because the real issue is not this specific tool. It is running any software on a machine that holds an active wallet.

Full article: https://matomba.substack.com/p/one-zip-file-one-empty-wallet-why

One environment for tools. One environment for assets. Never the same machine.

[craftyart1010]

We've been following this thread since it opened.

The SamFW case is well-documented at this point — Trojan.Dropper confirmed by Malwarebytes, fake timestamp set to 2097, sandbox evasion by design, version 5.4 pulled immediately after the theft.

We wrote a full breakdown — not about who is guilty, but about the opsec failure that made this possible in the first place. Because the real issue is not this specific tool. It is running any software on a machine that holds an active wallet.

Full article: https://matomba.substack.com/p/one-zip-file-one-empty-wallet-why

One environment for tools. One environment for assets. Never the same machine.

Thank you so much for all your efforts.

7955375aa728bcd66fd0778674cd279d8bb911bf0ff553bc09c7a5e05aebcdee

A small donation sent to support a helping community and help raise awareness about this samfwscam.

Everyone please don’t underestimate it this is a highly sophisticated, smart scam, and right now everyone is at risk.

I’m offering a donation to people who help spread the warning about samfw and make this samfwfrpscam more public so that no one else has to get scammed like I did.

So far, I’ve warned many people about the scam and helped them understand the risks. I’ve also guided them through uninstalling the samfw malicious software, and recommended formatting their computers and switching to Ubuntu or Linux Mint.

[xmrbro]

Hello, I came across your topic by chance and I sincerely sympathize with your loss. I hope you find peace and are able to overcome it. The case is very complex and important, which is why I wrote a detailed post on a Tor forum with the goal of warning other people and protecting them. Since I am also a German speaker, I translated it and posted it in the German-speaking community on BT.

https://bitcointalk.org/index.php?topic=5589494.msg66981449

[craftyart1010]

Hello, I came across your topic by chance and I sincerely sympathize with your loss. I hope you find peace and are able to overcome it. The case is very complex and important, which is why I wrote a detailed post on a Tor forum with the goal of warning other people and protecting them. Since I am also a German speaker, I translated it and posted it in the German-speaking community on BT.

https://bitcointalk.org/index.php?topic=5589494.msg66981449

Thank you for helping spread awareness about samfw as a scam and warning other users.

7a0a8dbc89fdd03f48166064fa2387575c45ab051e53a4fa92128527f0cbe93d

A small donation sent to support a helping community and help raise awareness about this samfwscam.

Do not download, install, or use anything from samfw.com. New accounts online are posting that “Samfw is safe” and claiming any security detections are false positives. These posts are part of scam operations done by scammer tungtata. I’m doing my best to share clear details with the community so nobody gets scammed by this tool. It created by Đặng Thanh Tùng (also shown under names like Tungtata / Đặng Thanh Tùng). I’ll keep posting what I find, and I’ll monitor his activity. My goal is to expose the wider samfw scam network he’s been operating for years and that has earned people’s trust with fake posts.

[albon]

Thank you for helping spread awareness about samfw as a scam and warning other users.

I have a LinkedIn account with more than 2,000 followers, and a Medium account with more than 280 followers.

If you'd like me to publish your content there, feel free to send me a PM on the forum with the complete content in a TXT file, and I'll post it.

The goal is to spread awareness and help this content rank in search engines, so it may prevent others from becoming victims of this malicious tool.

New accounts online are posting that “Samfw is safe” and claiming any security detections are false positives. These posts are part of scam operations done by scammer tungtata. I’m doing my best to share clear details with the community so nobody gets scammed by this tool.

This is misleading marketing, and unfortunately it can harm many people who may end up getting scammed, just as it happened to you because of the misleading information being widely promoted about this tool.

I truly hope your efforts help you recover your losses and protect potential users of this tool from becoming victims of having their devices compromised.

[craftyart1010]

Thank you for helping spread awareness about samfw as a scam and warning other users.

I have a LinkedIn account with more than 2,000 followers, and a Medium account with more than 280 followers.

If you'd like me to publish your content there, feel free to send me a PM on the forum with the complete content in a TXT file, and I'll post it.

The goal is to spread awareness and help this content rank in search engines, so it may prevent others from becoming victims of this malicious tool.

New accounts online are posting that “Samfw is safe” and claiming any security detections are false positives. These posts are part of scam operations done by scammer tungtata. I’m doing my best to share clear details with the community so nobody gets scammed by this tool.

This is misleading marketing, and unfortunately it can harm many people who may end up getting scammed, just as it happened to you because of the misleading information being widely promoted about this tool.

I truly hope your efforts help you recover your losses and protect potential users of this tool from becoming victims of having their devices compromised.

Two articles have been sent thank you, albon. Also, good news: their website is marked as Ethereum phishing.

samfwscam “Trojan.dropper” in SamFw Tool #272509

https://github.com/MetaMask/eth-phishing-detect/issues/272509

Samfw is distributing malware stealthily. I’m telling you: if you don’t have important things on your computer, the tool may seem to work without issue. But if you have crypto wallets and seed phrases stored on your computer, they can drain your funds. They use trojan droppers to install a RAT and other malware on your device.

This “samfwscam” is very smart and sophisticated. Do not download or install their scam tool. This is a public warning.

Keywords: samfwscam, SAMFW scam, malware warning, trojan dropper, RAT, remote access trojan, stealth malware, crypto wallet, seed phrase, seed theft, crypto drain, cybersecurity, scam tool, phishing, malware distribution, malware protection, stay safe online

Scammer tungtata offer "one-click" solutions (FRP bypass, CSC changes) to entice users, particularly those seeking technical workarounds for mobile devices. But there is something hidden behind the samfwtool.

Key technical findings, documented publicly:

    Malwarebytes analyzed the installer and identified a Trojan.Dropper payload: C:\1\1\1\SAMFWTOOLSETUP.EXE

    VirusTotal flagged version 5.4 across multiple engines — classifications include Trojan, PUA, and heuristic detections

    The file contained a fake timestamp set to year 2097 — a known anti-forensics technique

    The tool refused to run in VirtualBox and sandboxed environments — by design

    Version 5.4 was deleted from the official site shortly after the theft, replaced with 5.5


https://substack.com/home/post/p-208528787 - read more about samfwscam

[craftyart1010]

I’ve been scammed by Samfw, and I’m doing everything I can to warn others not to fall for this Vietnamese scammer. They are using sophisticated methods to connect to your device and steal credentials, accounts, and wallet funds. Please take this seriously and protect yourselves. Also do not believe Trustpilot reviews. Scammer tungtata buys them to fake it.

After I submitted my request, Malwarebytes Senior Research Engineer ran a test on SamFwToolSetup and found a malicious payload.
“Trojan.dropper” in SamFw Tool means it’s typically installs or delivers additional malicious software to your system after it runs.
Links

What I need from you:
Post warnings about Samfw scams on Twitter/X, Forum posts, Reddit, Blog posts, and other social platforms.
Share awareness through forum posts, community threads, and blog posts.
Encourage people not to trust paid promotions or “samfw safe tool” reviews that misleading.

Goal: prevent more people from falling for this scam and drive attention to it publicly. Malwarebytes Senior Research Engineer confirmed that the tool contain malware by running a test on SamFwToolSetup and detecting a malicious payload.

They found “Trojan.dropper” in SamFw Tool means it’s typically installs or delivers additional malicious software to your system after it runs.

Compensation: I will pay you based on the impact you generate (e.g., number of quality posts, engagement, and visibility).

If you’re willing to help, please reach me on simpleX

https://smp8.simplex.im/a#CKz44Y37y9tOGvyLSuzj0sutv-bJt7mfdVn1c-OMJ44

This is meant to warn people about tool scams: don’t download or install unknown tools on your computer. I was scammed by samfw, and I’m doing my best to alert others and raise public awareness.

I’ll do my best to stay on this case and stop the Vietnamese scammer Đặng Thanh Tùng from defrauding more people. I’m confident he has already compromised thousands of computers, and the main thing he’s after is wallet seed phrases.

http://tungtatascam.com
https://www.samfwscam.com
https://matomba.substack.com/p/one-zip-file-one-empty-wallet-why

[craftyart1010]

Warning: Samfw / Samfwtool is a scam. Do not install or run it.

Do not download, install, or run any software from samfw.com.

Multiple new accounts online claim “samfw is safe” and state that any detections are false positives. These accounts are part of the scam operation. Samfwtool contains malware and is designed to steal credentials and wallet access.

From my own experience: after installing SamFwToolSetup_v5.4.zip, my XMR Feather wallet with about $3 million was drained shortly afterward. This is why I’m warning people to be extremely careful: do not run it on your main computer, especially if you have wallets, seed phrases, private keys, or other sensitive data stored on it.
What to do

    Do not run it.
    Do not install it.
    Do not test it on any device where you store sensitive information.
    If you choose to do anything related to it, do it only in an isolated environment with nothing of value on it (no wallets, no seeds, no keys, no important accounts).

Reviews and “proof”

Do not trust Trustpilot reviews or other positive reviews. Scammers buy fake reviews and post misleading “success” reports to make the tool look legitimate. They also use SEO and blog activity to spread the lie that there is no malware. Scammer name: Đặng Thanh Tùng (also shown as Tungtata / Đặng Thanh Tùng) Based in Hanoi Capital of Vietnam.

Do not believe the positive reviews do not install Samfw.

https://medium.com/@albon/samfw-scam-exposed-credential-wallet-theft-warning-ab45b6884ce9

Samfw Scam Exposed: Credential & Wallet Theft Warning

CRITICAL WARNING: SAMFW Scam & Wallet Theft

https://www.linkedin.com/posts/albonbtc_samfw-scam-exposed-credential-wallet-theft-activity-7488967178763874304-33hc

[craftyart1010]

SamFw Uses Fake Reviews to Steal Your Data

The SamFw Tool is a dangerous infostealer and Trojan dropper operated by the individual known as Đặng Thanh Tùng, which covertly harvests private keys, saved passwords, and browser data to drain cryptocurrency wallets while using sophisticated SEO manipulation and fake reviews to deceive the community into trusting the malicious samfw software.

Trojan.Dropper Capability: The samfw acts as a dropper, meaning its primary function upon execution is to install additional, more potent malicious software in the background.

Infostealer Functionality: Once samfw installed, the malware is designed to scrape sensitive data, including:

Saved browser passwords and session cookies.
Cryptocurrency wallet private keys and seed phrases.
Personal files and system credentials.

The operation behind SamFw associated with scammer Đặng Thanh Tùng (Tungtata)

Strategy and Tactics SamFw uses:

Fake Reviews: Constant influx of positive reviews on platforms like Trustpilot to bury genuine complaints.
SEO Manipulation : Using bot accounts across forums and social media to claim that anti-virus detections are "false positives."
Paid Promotion: Sponsoring "tutorial" blogs and videos to create a false sense of trust and utility for the samfw.

Do not download, install, or execute any files from samfw.com. Protect your digital identity and your assets by avoiding these tools entirely.

Keywords:
Tungtata scam, Tungtata fraud, Dang Thanh Tung scam, samfw scam, samfw malware, samfw trojan, samfw security risk, samfw suspicious software, Tungtata trojan virus, samfw warning, Đặng Thanh Tùng scammer, owner Đặng Thanh Tùng fraud, tungtata scam, DangThanhTung scammer, DangThanhTung fraud, DangThanhTung rat trojan

[craftyart1010]

I want to raise awareness about the Samfwscam: after installing SamFwTool (SamFwToolSetup_v5.4.zip), my XMR Feather wallet that I had open was drained shortly afterward, and when I tried to contact the admin/operator Tung Tạtạ (tungtata) on Telegram, he blocked me and send me laughing emoji, so I’m warning people to be extremely careful don’t run this tool on your main computer (especially if you keep wallets, seed phrases, private keys, or other sensitive data there), because they use sophisticated methods to access devices and steal credentials and wallet funds; please take this seriously, and don’t rely on Trustpilot reviews since scammer tungtata buy fake positive reviews, and even though it hurts, I’m not giving up because I want to help protect more people from this samfwscam.

What I need from you:
Post warnings about Samfw scams on Twitter/X, Reddit, Youtube, and other social platforms.
Share awareness through forum posts, community threads, and blog posts.

https://bitcointalk.org/index.php?topic=5590575.0

[mabji1]

I want to raise awareness about the Samfwscam: after installing SamFwTool (SamFwToolSetup_v5.4.zip), my XMR Feather wallet that I had open was drained shortly afterward, and when I tried to contact the admin/operator Tung Tạtạ (tungtata) on Telegram, he blocked me and send me laughing emoji, so I’m warning people to be extremely careful don’t run this tool on your main computer (especially if you keep wallets, seed phrases, private keys, or other sensitive data there), because they use sophisticated methods to access devices and steal credentials and wallet funds; please take this seriously, and don’t rely on Trustpilot reviews since scammer tungtata buy fake positive reviews, and even though it hurts, I’m not giving up because I want to help protect more people from this samfwscam.

What I need from you:
Post warnings about Samfw scams on Twitter/X, Reddit, Youtube, and other social platforms.
Share awareness through forum posts, community threads, and blog posts.

https://bitcointalk.org/index.php?topic=5590575.0

Thanks for sharing. I’m sorry that happened. For anyone reading: don’t install unknown tools/executables, especially ones claiming to “unlock/repair” wallets or devices. If you already installed anything suspicious, disconnect the device from the internet, don’t open/enter seed phrases, and consider wiping/reinstalling from trusted media.

[craftyart1010]

I want to raise awareness about the Samfwscam: after installing SamFwTool (SamFwToolSetup_v5.4.zip), my XMR Feather wallet that I had open was drained shortly afterward, and when I tried to contact the admin/operator Tung Tạtạ (tungtata) on Telegram, he blocked me and send me laughing emoji, so I’m warning people to be extremely careful don’t run this tool on your main computer (especially if you keep wallets, seed phrases, private keys, or other sensitive data there), because they use sophisticated methods to access devices and steal credentials and wallet funds; please take this seriously, and don’t rely on Trustpilot reviews since scammer tungtata buy fake positive reviews, and even though it hurts, I’m not giving up because I want to help protect more people from this samfwscam.

What I need from you:
Post warnings about Samfw scams on Twitter/X, Reddit, Youtube, and other social platforms.
Share awareness through forum posts, community threads, and blog posts.

https://bitcointalk.org/index.php?topic=5590575.0

Thanks for sharing. I’m sorry that happened. For anyone reading: don’t install unknown tools/executables, especially ones claiming to “unlock/repair” wallets or devices. If you already installed anything suspicious, disconnect the device from the internet, don’t open/enter seed phrases, and consider wiping/reinstalling from trusted media.

How can you know that ? ? this scammer, Tungtata, is doing SEO and posting fake reviews and videos about a “safe” tool? Anyone who does a small amount of research believes the tool is safe. They’re running a very sophisticated scam.

Tungtata is a scammer and should go to jail. He has scammed many people, including me, but I’m sure others suspected it only later because this scammer is a real criminal.

Samfwtool actually contains malware, even if it appears to work.

Keywords:
Samfw virus, Tungtata scam, Tungtata fraud, Dang Thanh Tung scam, samfw scam, samfw malware, samfw trojan, samfw security risk, samfw suspicious software, Tungtata trojan virus, samfw warning, Đặng Thanh Tùng scammer, owner Đặng Thanh Tùng fraud, tungtata scam, DangThanhTung scammer, DangThanhTung fraud, DangThanhTung rat trojan

Warning: Samfw/Samfwtool Scam | Do Not Install

https://github.com/MetaMask/eth-phishing-detect/issues/280638 - samfw.com is distributing a trojan (crypto) wallet drainer

[craftyart1010]

Hello, I had this same issue with samfw. I was skeptical all through when attempting to use the software and I decided to run it a sandbox when it was too late! I had the very little solana I had in a dormant wallet stolen, my facebook account had repeated attempts of a hack, even my reddit account got infiltrated and posts about softwares (i assume also contain the same malware) were posted via my reddit account. It would take me some time to provide this all into one coherent post with proof of my ordeal with samfw because as of October 2025, I was the only one with this issue when I looked it up on the internet. As you correctly mentioned, everyone else kept on tagging the software as 'safe'

https://github.com/samfwnotsafe/samfw-malware/issues/1#issuecomment-5240273148

Samfw is a scam run by Vietnamese scammer by Đặng Thanh Tùng (also shown as “Tungtata”). I’m sure there are more victims, and although many have already given up fighting, I won’t. This scammer is still looking to scam more users.

Please help me reach more people so more victims come forward. Do not install or run anything related to Samfw any of his tools or anything else connected to him is malicious and risky.

This person lives in Hanoi, Vietnam. His scam case has already been reported to A05 (Department of Cybersecurity and High-Tech Crime Prevention), the primary unit under the Ministry of Public Security in Vietnam.

He became online on Telegram or on this forum, but he not replying.

[albon]

https://github.com/MetaMask/eth-phishing-detect/issues/280638 - samfw.com is distributing a trojan (crypto) wallet drainer

If MetaMask has blacklisted the SamFW domain and blocked it, so why doesn’t MetaMask’s warning message appear when the domain is opened?

Does the warning message appear for you or not?

This warning is important because it can stop a lot of people from opening the website and installing the software on their computers.

-----------------

https://github.com/samfwnotsafe/samfw-malware/issues/1#issuecomment-5240273148

I’m sure there are more victims, and although many have already given up fighting, I won’t. This scammer is still looking to scam more users.

It’s good that you’re pointing out that more victims are coming forward, which could mean that the risks associated with this software could be getting worse.

I hope this person shares their full story, along with evidence supporting their claims and verifiable blockchain evidence showing that they really lost these funds in Solana and where the money ended up.

[craftyart1010]

https://github.com/MetaMask/eth-phishing-detect/issues/280638 - samfw.com is distributing a trojan (crypto) wallet drainer

If MetaMask has blacklisted the SamFW domain and blocked it, so why doesn’t MetaMask’s warning message appear when the domain is opened?

Does the warning message appear for you or not?

This warning is important because it can stop a lot of people from opening the website and installing the software on their computers.

-----------------

https://github.com/samfwnotsafe/samfw-malware/issues/1#issuecomment-5240273148

I’m sure there are more victims, and although many have already given up fighting, I won’t. This scammer is still looking to scam more users.

It’s good that you’re pointing out that more victims are coming forward, which could mean that the risks associated with this software could be getting worse.

I hope this person shares their full story, along with evidence supporting their claims and verifiable blockchain evidence showing that they really lost these funds in Solana and where the money ended up.

Metamask is blocked samfw, but I don’t see any warning when I enter their site. I don’t know what the scammer “tungtata” is doing, or whether there’s an issue with Metamask. The warning message doesn’t appear for me.

This is important: I’ve already been scammed by Samfw, so I want to help others avoid it.

-----------------

I hope other users come here to post more evidence. SAMFW is a scam tool, and I know there are more victims. Justice will eventually come out as long as I don’t stop. I will never stop.

[mabji1]

I want to raise awareness about the Samfwscam: after installing SamFwTool (SamFwToolSetup_v5.4.zip), my XMR Feather wallet that I had open was drained shortly afterward, and when I tried to contact the admin/operator Tung Tạtạ (tungtata) on Telegram, he blocked me and send me laughing emoji, so I’m warning people to be extremely careful don’t run this tool on your main computer (especially if you keep wallets, seed phrases, private keys, or other sensitive data there), because they use sophisticated methods to access devices and steal credentials and wallet funds; please take this seriously, and don’t rely on Trustpilot reviews since scammer tungtata buy fake positive reviews, and even though it hurts, I’m not giving up because I want to help protect more people from this samfwscam.

What I need from you:
Post warnings about Samfw scams on Twitter/X, Reddit, Youtube, and other social platforms.
Share awareness through forum posts, community threads, and blog posts.

https://bitcointalk.org/index.php?topic=5590575.0

Thanks for sharing. I’m sorry that happened. For anyone reading: don’t install unknown tools/executables, especially ones claiming to “unlock/repair” wallets or devices. If you already installed anything suspicious, disconnect the device from the internet, don’t open/enter seed phrases, and consider wiping/reinstalling from trusted media.

How can you know that ? ? this scammer, Tungtata, is doing SEO and posting fake reviews and videos about a “safe” tool? Anyone who does a small amount of research believes the tool is safe. They’re running a very sophisticated scam.

Tungtata is a scammer and should go to jail. He has scammed many people, including me, but I’m sure others suspected it only later because this scammer is a real criminal.

Samfwtool actually contains malware, even if it appears to work.

Keywords:
Samfw virus, Tungtata scam, Tungtata fraud, Dang Thanh Tung scam, samfw scam, samfw malware, samfw trojan, samfw security risk, samfw suspicious software, Tungtata trojan virus, samfw warning, Đặng Thanh Tùng scammer, owner Đặng Thanh Tùng fraud, tungtata scam, DangThanhTung scammer, DangThanhTung fraud, DangThanhTung rat trojan

Warning: Samfw/Samfwtool Scam | Do Not Install

https://github.com/MetaMask/eth-phishing-detect/issues/280638 - samfw.com is distributing a trojan (crypto) wallet drainer

How can you know that ? ?

You don’t but just google virustotal.com after you saw those viruses on VirusTotal so why did it run?

[noorman0]

Metamask is blocked samfw, but I don’t see any warning when I enter their site. I don’t know what the scammer “tungtata” is doing, or whether there’s an issue with Metamask. The warning message doesn’t appear for me.

This is important: I’ve already been scammed by Samfw, so I want to help others avoid it.

-----------------

I hope other users come here to post more evidence. SAMFW is a scam tool, and I know there are more victims. Justice will eventually come out as long as I don’t stop. I will never stop.

MetaMask relies on third-party phishing detection infrastructure, such as CryptoScamDB. You can publicly check whether or not your report has been acted upon. It appears your report has not yet been addressed: https://app.chainpatrol.io/search?content=samfw.com

[craftyart1010]

Metamask is blocked samfw, but I don’t see any warning when I enter their site. I don’t know what the scammer “tungtata” is doing, or whether there’s an issue with Metamask. The warning message doesn’t appear for me.

This is important: I’ve already been scammed by Samfw, so I want to help others avoid it.

-----------------

I hope other users come here to post more evidence. SAMFW is a scam tool, and I know there are more victims. Justice will eventually come out as long as I don’t stop. I will never stop.

MetaMask relies on third-party phishing detection infrastructure, such as CryptoScamDB. You can publicly check whether or not your report has been acted upon. It appears your report has not yet been addressed: https://app.chainpatrol.io/search?content=samfw.com

On the thread, it already says this

AlexHerman1

blocked thanks

Samfwscam was also posted on RipoffReport.

https://www.ripoffreport.com/report/samfw-frp-tool/hanoi-internet-scam-com-csc-i-1542449

I’ve been scammed by Samfw, and I’m doing everything I can to warn others not to fall for this Vietnamese scammer. They are using sophisticated methods to connect to your device and steal credentials, accounts, and wallet funds. I won’t leave this behind. One day justice will come I’ll wait for that day. When the scammer, Tunggata, goes to prison, that will be my justice.

Scammer name is Đặng Thanh Tùng (also shown as Tungtata / main developer of “SamFW” and MiFirm.net ) Based in Hanoi Capital of Vietnam

[noorman0]

On the thread, it already says this

Idk,
He might have forgotten to add it or made a typo; but I haven't seen his contribution for this month yet.
Based on past activity, samfw should be listed in this file: src/config.json. cmiiw