{"id":93839,"date":"2019-01-15T17:22:34","date_gmt":"2019-01-16T01:22:34","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=93839"},"modified":"2025-08-13T00:15:46","modified_gmt":"2025-08-13T07:15:46","slug":"cryptomix-ransomware-scam","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/cryptomix-ransomware-scam\/","title":{"rendered":"Children\u2019s Charity or CryptoMix? Details on This Ransomware Scam"},"content":{"rendered":"

As ransomware threats become more sophisticated, the tactics cybercriminals use to coerce payments from users become more targeted as well. And now, a stealthy strain is using deceptive techniques to mask its malicious identity. Meet CryptoMix ransomware<\/a>, a strain that disguises itself as a children\u2019s charity in order to trick users into thinking they\u2019re making a donation instead of a ransom payment. While CryptoMix has used this guise in the past, they’ve recently upped the ante by using legitimate information from crowdfunding pages for sick children to further disguise this scheme.<\/p>\n

So, how does CryptoMix trick users into making ransom payments? First, the victim receives a ransom note containing multiple email addresses to contact for payment instructions. When the victim contacts one of the email addresses, the “Worldwide Children Charity Community” responds with a message containing the profile of a sick child and a link to the One Time Secret site. This website service allows users to share a post that can only be read once before it’s deleted. CryptoMix\u2019s developers use One Time Secret to distribute payment instructions to the victim and explain how their contribution will be used to provide medical help to sick children. The message claims that the victim’s data will be restored, and their system will be protected from future attacks as soon as the ransom is paid. In order to encourage the victim to act quickly, the note also warns that the ransom price could double in the next 24 hours.<\/p>\n

\"\"<\/p>\n

After the victim makes the payment, the ransomware developers send the victim a link to the decryptor. However, they continue to pretend they are an actual charity, thanking the victim for their contribution and ensuring that a sick child will soon receive medical help.<\/p>\n

Keep Your Data Safe From Ransomware<\/h2>\n

CryptoMix\u2019s scam tactics show how ransomware developers are evolving their techniques to ensure they make a profit. As ransomware threats become stealthier and more sophisticated, it’s important for users to educate themselves on the best techniques to combat these threats. Check out the following tips to help keep your data safe from ransomware:<\/p>\n