Edit: @xcartermurphy (X impersonation account)

Title / name *

Summary *

Category *

Scam type *

Severity *

Chain

Token

Amount lost (USD)

Image

Upload

Paste a link or upload a file (max 5 MB).

Details (Markdown supported)

> **Note:** This entry is based on a single public X post whose author was not recorded and which may since have been deleted. It includes inferences that are clearly marked **unverified**, and is published as a community warning — not a finding of fact about any individual's identity or nationality.

## Summary

`@xcartermurphy` is an X (formerly Twitter) account described in a public post as an impersonation account connected to a malware-focused social-engineering operation. The account's profile lists a 2009 creation date, but the reported activity is recent. [1]

## What the post described

- The post (author not recorded; likely since deleted) included a screenshot of a direct-message chat between the poster and `@xcartermurphy`. [1]
- The account that shared the screenshot presented itself as a startup founder funded by a well-known venture capital firm (the firm is intentionally not named here). The post characterized that account as complicit in the operation — an **unverified** allegation. [1]
- In the screenshot, `@xcartermurphy`'s bio displayed that VC firm's tag; per the post it has since been removed. [1]
- The post's author said they were personally targeted: one vector was an attempt to get them to install a malware-laden version of the **WeChat** messaging app, delivered by email. [1]
- Linked infrastructure: a now-scrubbed domain `host01eu[.]com` hosted setup instructions that included a `curl` command fetching content from `californiasmallbusinesslaw[.]com`. [1]

## Assessment (unverified)

The post's author speculated the operator might be based in China or linked to North Korea — an inference drawn from the attack methods rather than confirmed attribution. **The wiki treats the operator's nationality and identity as unverified.** The described pattern — impersonating a funded founder/recruiter to push a malicious app or a `curl`-piped install command — resembles documented social-engineering campaigns that target developers and crypto workers, including the North Korea-linked "Contagious Interview" operation tracked by Palo Alto Networks' Unit 42. This resemblance is offered for context only and is not an attribution of this specific account. [2]

## Indicators of compromise (defanged)

- X account: `@xcartermurphy`
- Domains: `host01eu[.]com`, `californiasmallbusinesslaw[.]com`
- Lure: a malware-laden "WeChat" installer; a `curl`-based install command

_Bracketed numbers refer to the numbered sources listed below._

Aliases (one per line)

Wallets (chain:address per line)

Propose an edit