• They run fake remote-job ads on Google leading to landing pages.
  


• Traffic is dynamically routed via IP to specific WhatsApp groups (hundreds of them).
  


• Each group is seeded with ~30 bot accounts pretending to be Spanish workers hyping up the "job". They run it like a meat grinder: they invite 2 real victims at a time into the group. Once those real victims do the tasks and get milked dry, they are immediately kicked out, and the cycle repeats endlessly with new victims.


• Victims register on their main fake crypto/exchange platform to do "tasks" that eventually go into negative balance, forcing them to deposit real crypto to clear it. Manual deposits via live chat.
  

• The exact URLs of their entry nodes, chat servers, and backend API.
  


• The exact GitHub repos they cloned their frontend (Vue3) and backend (Java Spring Boot) from.
  


• Proof of the chat breach and the exact tech stack.
  

(Apr 26, 2026 11:29 AM)NotJinx Wrote:   Massive Chinese "Task Scam" Syndicate (Crypto) - Need Heavy Hitter for Backend / DB Dump

What's up HF.

I've been tracking a massive, highly organized Chinese scam syndicate targeting the EU (specifically Spain right now). They run a classic "Task/Order Grabbing" Advanced Fee Fraud, entirely fueled by USDT/ETH. They are pulling in thousands of euros daily from victims.

I'm not asking for someone to hold my hand. I've already done deep recon on their entire infrastructure and successfully popped their live customer service panel.

The Setup (High Level):

• They run fake remote-job ads on Google leading to landing pages.
  


• Traffic is dynamically routed via IP to specific WhatsApp groups (hundreds of them).
  


• Each group is seeded with ~30 bot accounts pretending to be Spanish workers hyping up the "job". They run it like a meat grinder: they invite 2 real victims at a time into the group. Once those real victims do the tasks and get milked dry, they are immediately kicked out, and the cycle repeats endlessly with new victims.


• Victims register on their main fake crypto/exchange platform to do "tasks" that eventually go into negative balance, forcing them to deposit real crypto to clear it. Manual deposits via live chat.
  

My Breach:
I managed to breach their live chat admin panel. They are using an open-source Go/PHP chat application and they left the default JWT signing key active. I generated a forged admin token, got in, and saw the absolute bloodbath. Thousands stolen, victims' IDs (passports/national IDs) uploaded, manual wallet addresses being dropped.
I was mapping their network, but I got detected and they forced a logout / rotated the secret.

What I Have (The Dossier):
I have compiled a detailed .txt file with:

• The exact URLs of their entry nodes, chat servers, and backend API.
  


• The exact GitHub repos they cloned their frontend (Vue3) and backend (Java Spring Boot) from.
  


• Proof of the chat breach and the exact tech stack.
  

What I Need:
I need a heavy hitter who specializes in API exploitation, Spring Boot vulnerabilities, or zero-days for these Chinese open-source frameworks (Yudao/RuoYi). Their frontend encrypts passwords with RSA, but their backend API actually accepts plaintext and throws length errors—their security is sloppy.
I want someone to pop the backend, dump the DB, and ideally drain the manual wallets they use to collect the USDT.

I am not paying upfront for a "service". I am offering all my intel for a JV/revenge op. If you pop them, you keep the crypto you drain. I just want to see them burn.

PM me if you have the skills to hit a Spring Boot API and want the target dossier (.txt). Don't waste my time if you're a skid.

(Apr 26, 2026 11:29 AM)NotJinx Wrote:   Massive Chinese "Task Scam" Syndicate (Crypto) - Need Heavy Hitter for Backend / DB Dump

What's up HF.

I've been tracking a massive, highly organized Chinese scam syndicate targeting the EU (specifically Spain right now). They run a classic "Task/Order Grabbing" Advanced Fee Fraud, entirely fueled by USDT/ETH. They are pulling in thousands of euros daily from victims.

I'm not asking for someone to hold my hand. I've already done deep recon on their entire infrastructure and successfully popped their live customer service panel.

The Setup (High Level):

• They run fake remote-job ads on Google leading to landing pages.
  


• Traffic is dynamically routed via IP to specific WhatsApp groups (hundreds of them).
  


• Each group is seeded with ~30 bot accounts pretending to be Spanish workers hyping up the "job". They run it like a meat grinder: they invite 2 real victims at a time into the group. Once those real victims do the tasks and get milked dry, they are immediately kicked out, and the cycle repeats endlessly with new victims.


• Victims register on their main fake crypto/exchange platform to do "tasks" that eventually go into negative balance, forcing them to deposit real crypto to clear it. Manual deposits via live chat.
  

My Breach:
I managed to breach their live chat admin panel. They are using an open-source Go/PHP chat application and they left the default JWT signing key active. I generated a forged admin token, got in, and saw the absolute bloodbath. Thousands stolen, victims' IDs (passports/national IDs) uploaded, manual wallet addresses being dropped.
I was mapping their network, but I got detected and they forced a logout / rotated the secret.

What I Have (The Dossier):
I have compiled a detailed .txt file with:

• The exact URLs of their entry nodes, chat servers, and backend API.
  


• The exact GitHub repos they cloned their frontend (Vue3) and backend (Java Spring Boot) from.
  


• Proof of the chat breach and the exact tech stack.
  

What I Need:
I need a heavy hitter who specializes in API exploitation, Spring Boot vulnerabilities, or zero-days for these Chinese open-source frameworks (Yudao/RuoYi). Their frontend encrypts passwords with RSA, but their backend API actually accepts plaintext and throws length errors—their security is sloppy.
I want someone to pop the backend, dump the DB, and ideally drain the manual wallets they use to collect the USDT.

I am not paying upfront for a "service". I am offering all my intel for a JV/revenge op. If you pop them, you keep the crypto you drain. I just want to see them burn.

PM me if you have the skills to hit a Spring Boot API and want the target dossier (.txt). Don't waste my time if you're a skid.