Scam Groups Impersonate Jupiter to Distribute Fake CJUP Tokens

Panewslab

Scam Groups Impersonate Jupiter to Distribute Fake CJUP Tokens

First seen 22 May 2026, 10:26 UTC • •54.6

Article Content

1 / 4

Browse articles

ThreatCluster •May 23, 2026 at 10:25 UTC

•Scam groups are impersonating Jupiter to distribute fake CJUP tokens.
•Users are being lured to phishing websites to steal assets.
•Monitoring by SolanaFloor and ChainCatcher confirms the ongoing threat.

On May 22, 2026, reports emerged of a scam group impersonating Jupiter by airdropping fake CJUP tokens into users' wallets. This fraudulent activity aims to lure victims into connecting to phishing websites, resulting in asset theft. Monitoring by SolanaFloor and ChainCatcher confirmed the ongoing scams, which exploit the reputation of Jupiter to deceive users. The exact number of affected users is currently unknown, but the attack vector poses a significant risk to individuals holding or trading CJUP tokens. Users are advised to remain vigilant and avoid connecting to unknown websites. The situation is actively being monitored by security researchers and platforms.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 121d ago How this analysis works

Timeline

2026-05-22

Scam group impersonates Jupiter

Fraudsters are airdropping fake CJUP tokens into wallets, leading users to phishing sites.

2026-05-22

Monitoring confirms ongoing scams

ChainCatcher and SolanaFloor report on the impersonation and phishing tactics employed by the scam group.

More articles in this cluster (3)

Threat Graph

3 entities, 2 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Phishing
T1566.002 - Spearphishing Link

Affected Platform (1)

Solana

Relationships

Phishing targets Solana
T1566.002 - Spearphishing Link targets Solana

Continue Reading

Critical WSO2 API Manager Vulnerability Under Active Exploitation A critical vulnerability (CVE-2026-5430) in WSO2 API Manager is being actively exploited, allowing unauthenticated attackers to forge admin tokens via JWT authentication bypass. This flaw, which has a CVSS score of 10.0, affects multiple WSO2 products including API Manager, Universal Gateway, Traffic Manager, and API…

Critical Linux Kernel Vulnerability CVE-2025-39682 Under Active Exploitation A critical vulnerability (CVE-2025-39682) in the Linux kernel allows remote code execution through mishandling of zero-length TLS records. This flaw affects kTLS-enabled hosts running vulnerable kernel versions, exposing them to attackers without authentication. CISA added this vulnerability to its Known Exploited…