Crypto-Enabled Internship Fraud Campaign · Correlation: MutaEngine | VRV Security | Zorvyn FinTech
This report documents a coordinated internship fraud network actively targeting technology and cybersecurity job seekers globally since at least mid-2024. The operation creates elaborate fake companies with professional-grade websites, employee portals, legally styled offer letters, and automated onboarding infrastructure — then solicits cryptocurrency payments for a software product called MutaCryptor by MutaEngine.
Two confirmed fake company shells: VRV Security and Zorvyn FinTech. The author was personally targeted by Zorvyn FinTech in April 2026, enabling firsthand documentation of the complete 8-phase attack chain. Infrastructure collapsed (NXDOMAIN) during active investigation. Critical finding: Bitcoin-only payment with 15-minute rotating wallet addresses — deliberately untraceable criminal financial architecture.
Mass screening invitations via Internshala, LinkedIn, and job platforms. Realistic timed technical assessments to build psychological investment.
90-minute multiple-choice assessment on real cybersecurity topics via branded portal (screening.zorvyn.live).
Formal offer letter with NDA, INR 45,000/month stipend (above market), PPO up to INR 16 LPA. CEO signature. "Zorvyn never charges fees" statement — designed to lower guard.
Employee portal access, welcome kit order (Dell Pro 14 laptop, merch). PII harvested: address, passport photo, ID card, banking details under cover of payroll setup.
Fake reporting manager Mudiwa Mkonto assigns 15-day training plan on real cybersecurity topics — adds credibility, primes the purchase.
Training task: purchase MutaCryptor from mutaengine.cloud. 48-hour deadline. "Do not use AI tools" instruction — prevents research. "Do not discuss with anyone" — isolation tactic.
Bitcoin-only checkout at pay.mutaengine.cloud. Dynamic rotating wallet addresses. 15-minute invoice expiry. Irreversible. No KYC. Funds routed through mixing services.
PII collected regardless of payment. Infrastructure torn down (NXDOMAIN) after exposure. Cycle restarts under new shell company identity.
Full attack chain documentation, threat actor profile, cryptocurrency obfuscation mechanism, correlation analysis, and law enforcement recommendations.
Download TI Report — TLP:WHITE