Consumer Protection & Financial Fraud Division
SecureLeaf has identified an active and sophisticated investment fraud operation targeting individuals through WhatsApp groups under the name "Clyra Capital." The operation employs advanced social engineering tactics, combining legitimate investment advice with psychological manipulation to ultimately defraud victims through a cryptocurrency pump-and-dump scheme centered around a fraudulent "AEA token."
This operation represents a textbook example of "pig butchering" fraud, where scammers build trust over time through seemingly legitimate investment guidance before introducing the actual scam. The operation is notable for its professional presentation, use of multiple personas, sophisticated psychological manipulation tactics, and active use of paid press release services to create false legitimacy.
The threat actors have paid for press release distribution on GlobeNewswire and other services, creating the false appearance that major financial news outlets are covering "Clyra Capital." These are paid advertisements, not journalism. Through automatic syndication, one paid press release now appears on dozens of sites including Barchart, MarketersMedia, and Manila Times. The press releases contain:
DO NOT be fooled by "news coverage" on multiple sites - this is ONE paid press release automatically republished everywhere, not independent journalism from multiple sources.
This operation demonstrates HIGH sophistication across multiple dimensions:
Victims receive unsolicited WhatsApp group invitations or are added to groups promising "exclusive investment opportunities." Initial messages are professional and welcoming, establishing the group as a legitimate investment advisory service.
Key Tactics:
The operation provides legitimate stock recommendations (SNAP, GAP) that may result in actual profits. This critical phase establishes credibility and overcomes victim skepticism.
Key Tactics:
Victims are introduced to a "points system" where they earn rewards for daily engagement, completing tasks, and interacting with group content. This creates psychological investment through sunk cost fallacy.
Key Tactics:
Once trust is established and victims are engaged, the operation introduces the "AEA token" - a fraudulent cryptocurrency that is the actual target of the scam. The token is presented as an exclusive opportunity with limited availability.
Key Tactics:
Once victims invest in the AEA token, scammers will likely execute one of several exit strategies:
Expected Victim Impact:
Use of impressive titles ("Professor," "Mentor") and professional language creates false perception of expertise and legitimacy.
Coordinated fake testimonials from "other investors" showing huge profits manipulates victims into believing the opportunity is legitimate.
The points system creates psychological investment. After spending weeks accumulating points, victims feel they've already invested time and effort, making them more likely to commit financially.
Limited allocation and lottery system creates urgency and FOMO, overriding rational decision-making.
Starting with legitimate stock tips, then moving to small tasks, then bigger commitments, is a classic foot-in-the-door technique that gradually increases victim compliance.
The threat actors behind this operation have paid for press release distribution on legitimate wire services to create the appearance of credibility. These are not news articles - they are paid advertisements.
The paid press releases have been automatically syndicated to numerous websites, creating the false appearance of "multiple news sources" covering Clyra Capital. This is ONE paid advertisement appearing on many sites:
How Press Release Syndication Scams Work:
Note: Additional numbers likely exist as operation appears to be using multiple phone numbers for fake testimonials.
Number: +1 (929) 584-6035 ("Julian" - gold futures trading expert)
Network: T-Mobile US-SVR-10X/2 (MCCMNC 310260)
Account Type: Postpaid cellular (NOT VoIP)
Verification: HLR lookup performed November 11, 2025
Significance:
Law Enforcement Value:
Operational Security Weakness: While account may have been opened with fraudulent identity, the ongoing payment mechanism likely connects to actual operation funding sources. Payment interruption would disrupt scam operations.
All identified scam domains have been reported to their respective service providers for fraudulent activity:
These case IDs can be referenced when filing additional reports or contacting law enforcement.
Website Usage Patterns:
Following our fraud report (Ticket #944684), GlobeNewswire investigated the fraudulent press release, contacted the publisher, and issued a Notice of Disregard. The original fraudulent content has been removed from GlobeNewswire's website.
Why This Matters:
Remaining Challenges:
This enforcement action validates the importance of documenting and reporting fraud professionally. When security researchers provide detailed evidence and follow proper reporting procedures, even sophisticated scam operations can be disrupted.
WHOIS analysis of clyracapital.com reveals critical indicators consistent with fraudulent operations:
Based on verified evidence, the operation utilizes:
The threat actors demonstrate HIGH operational security awareness:
This level of OpSec suggests professional cybercriminal operation with experience in evading law enforcement and maintaining persistent infrastructure. The investment in paid press release syndication indicates significant financial resources and understanding of how to manipulate public perception through "news coverage."
Investment fraud operations of this sophistication typically involve:
Based on the level of sophistication and coordination, this operation likely:
SecureLeaf Cybersecurity
Consumer Protection & Financial Fraud Division
Division of Dispensight
Website: secureleaf.dispensight.com
Report Fraud or Request Assistance:
Email: [email protected]
Text: +1 (778) 744-8280