Florida man arrested Soon Tungtata/SamFW Uses the Same Malware and Wallet-Theft | Same Scam Pattern

Tungtata scam, Tungtata fraud, Dang Thanh Tung scam, samfw scam, samfw malware, samfw trojan, samfw security risk, samfw suspicious software

Same scam pattern has also been used by SamFW. Tungtata, a Vietnamese scammer, advertises on the internet that his ‘tool’ can remove FRP and other issues, but what it actually does is install malware on the victim’s computer. A similar scam has also been reported in MSN News, where malware is being installed through games. Tungtata did the same thing to his SamFW tool as well.

Another example of the same scheme is cryptocurrency trading bots contain malware and follow the same scam patterns.

Same scam patterns / method (how the scheme typically works):

• Social engineering via a fake “legit tool”: attacker markets a “one-click” FRP removal / support tool (or trading bot / game-related download) to earn trust and drive downloads.
• Malicious payload hidden inside the installer/package: the tool appears to be the promised utility, but the installer contains malware (e.g., RAT/trojan) or drops additional malicious files after execution.
• Pre-positioning to steal/monitor wallet access: once installed, the malware targets the victim’s crypto wallet(s)/browser data and can watch for wallet activity.
• Funds theft shortly after installation: the scam often empties wallets quickly (e.g., moving crypto out with unauthorized approvals/transactions).
• Anti-forensics / “version replacement”: after the theft, the attacker updates the download package (e.g., v5.5 replacing v5.4) and/or removes the exact version tied to evidence.
• Attacks across different themes but same delivery chain: FRP tools, trading bots, or even “games on Steam” are just different packaging/delivery lures—the underlying pattern is malware distribution + wallet compromise + rapid monetization.