N/A
(0 reviews)
- Direct payment (XMR)
Don’t Trust the SamFwTool - Malware Stealing Crypto (samfwscam)
Description
I’m sharing a real warning about the Samfw scam.
I was scammed after installing samfwtoolsetup_v5.4.zip. After running it, the scammer tungtata stole funds from my Feather Wallet. I did my best to contact him but he blocked me with laughing emoji. After the theft, the original tool package was removed and modified to reduce evidence, which is why I believe the attacker is preparing to target more victims.
Security testing (including confirmation reported by Malwarebytes) detected malware in the setup, including a detection for “Trojan.dropper.” A Trojan dropper typically means the program can install or deliver additional malicious software after it runs.
I want to prevent more people from falling for “safe tool” claims, especially any paid promotions or reviews that try to make this look legitimate. Do not download, install, or run any software from samfw.com!
What I need help with:
Posting scam warnings on Twitter/X, Youtube, Reddit, and other platforms
Writing awareness posts for forums, community threads, and blogs
Encouraging people not to trust paid “safe tool” reviews or unknown downloads
If you can help, contact me on SimpleX:
https://smp8.simplex.im/a#CKz44Y37y9tOGvyLSuzj0sutv-bJt7mfdVn1c-OMJ44
More details about samfwscam:
https://github.com/9623813/tungtata_scammer
https://96238132834.wixsite.com/samfwscam
https://www.tumblr.com/samfwtoolscam
https://github.com/tungtata/SamFw-Tool-Update/issues/1
https://www.trustpilot.com/reviews/6a3e2e1f7bded8c96b894260
http://tungtatascam.com/do-not-download-or-use-any-tools-from-samfw-com/
https://www.samfwscam.com/2026/06/27/d%E1%BA%B7ng-thanh-tung-tungtata-is-a-confirmed-scammer-and-malware-distributor/
https://github.com/tungtatascam
https://www.tumblr.com/tungtatascam
https://hackmd.io/@SamfwScam
https://archive.org/details/scammer_tungtata_pic2
https://archive.org/details/@samfwscam
https://github.com/samfwtoolscam
https://matomba.substack.com/p/one-zip-file-one-empty-wallet-why
https://bitcointalk.org/index.php?topic=5589494.msg66981449
https://hackmd.io/@samfwtoolscam
https://hackmd.io/@samfwfrpscam
https://forums.malwarebytes.com/topic/337471-undected-malware/
https://bitcointalk.org/index.php?topic=5586649.0
Category: Other
Tags: Tungtata scam, samfwscam, samfwscamtool, samfwscammer, Tungtata fraud, Dang Thanh Tung scam, samfw scam, samfw malware
Trust rating: Caution
Published on: August 6, 2026
Views: 7
Legal Notice: Buyers and sellers are responsible for complying with all applicable laws in their jurisdictions. XmrBazaar does not verify legality and assumes no liability. Peer-to-peer cash-for-crypto trades are permitted if not conducted as a business and are compliant with local laws; otherwise, sellers must hold any required licenses or registrations. Listings involving fraud, violence, child exploitation, or other clearly illegal goods or services are strictly prohibited and will be removed once identified. Users are encouraged to report unlawful listings.
About the trader
I’ve been scammed by Samfw, and I’m doing everything I can to warn others not to fall for this Vietnamese scammer. They are using sophisticated methods to connect to your device and steal credentials, accounts, and wallet funds. Please take this seriously and protect yourselves. Also do not believe Trustpilot reviews. Scammer tungtata buys them to fake it.
After I submitted my request, Malwarebytes Senior Research Engineer ran a test on SamFwToolSetup and found a malicious payload.
“Trojan.dropper” in SamFw Tool means it’s typically installs or delivers additional malicious software to your system after it runs.
http://tungtatascam.com
https://www.samfwscam.com
https://matomba.substack.com/p/one-zip-file-one-empty-wallet-why
-----BEGIN PGP PUBLIC KEY BLOCK----- mDMEAAAAABYJKwYBBAHaRw8BAQdAzHQ8qNZXTlSbM4UCcph+iZ3CGpjMikiYjba3 8Th8MPi0FGNyYWZ0eUB4bXJiYXphYXIuY29tiJQEExYKADwWIQSwDhgtvOfOyUfq CbFayw8MLTs5LQUCAAAAAAIbAwULCQgHAgMiAgEGFQoJCAsCBBYCAwECHgcCF4AA CgkQWssPDC07OS245wEAvy1evqRYHCViVrzo8A9MWBNfZ3wdl8jX/XmNZlkBtQ8B AMUovHbTLazu8dcYZhY7jI2bwF80221H7qGdnJ2Ow0YMuDgEAAAAABIKKwYBBAGX VQEFAQEHQIsYsZL2/0i3s6t2vpoqemgqRGLT1e8TZGXSw924KpNJAwEIB4h4BBgW CgAgFiEEsA4YLbznzslH6gmxWssPDC07OS0FAgAAAAACGwwACgkQWssPDC07OS3R 1QD+J//fgs3jtw57LVFoGSe2oqdnw37vxIkMZxsa0I4YTVAA/ie/Jz2UExeO242Z etPQPIIvAr6Ipi0mQevPbtlzy3oL =5f+g -----END PGP PUBLIC KEY BLOCK-----