A new scam is targeting users via physical transactions involving USDT, exploiting a modified remote procedure call (RPC) function on Ethereum nodes.

The victim is then instructed to change their ETH RPC URL to a node that has been maliciously modified and is under the control of the scammer.

After the user modifies the RPC URL, a falsified wallet balance is displayed on the victim’s end, leading them to believe that they have received a substantial amount of funds. When the user attempts to transfer the miner’s fees to cash out the USDT, they spot the deceit. By then, the scammer had removed all his traces and disappeared with the transferred fees.

“Users often focus only on whether funds have been credited to their wallets, overlooking potential risks. Scammers take advantage of this trust and negligence, using believable tactics such as transferring small amounts of money to deceive users,” researchers at Slowmist wrote.

Slowmist added that an investigation into one of the victim’s wallets revealed that it received 1 USDT and 0.002 ETH from the scammers’ address. Tracking that address showed that the scammer had sent 1 USDT to three other wallets.

The scammer’s address was associated with multiple trading platforms and was also flagged as “Pig Butchering Scammers” by the on-chain tracking tool MistTrack.

As such, Slowmist urged users to “remain vigilant during transactions,” adding that users should be “skeptical of others” to avoid being defrauded.