Phishing Links Found Targeting Users of the CAR Memecoin

Several cryptocurrency data sites are listing phishing links related to the Central African Republic (CAR) memecoin. Cybersecurity experts warn that investors

A memecoin purportedly launched by the Central African Republic (CAR) has attracted attention, but several cryptocurrency data sites are listing phishing links related to the token. Cybersecurity experts warn that investors searching for information on the coin may inadvertently click on these malicious links.

The CAR memecoin gained traction after an X account belonging to President Faustin-Archange Touadéra claimed that the government had launched the token. The announcement stated that the initiative aimed to “unite people” and contribute to “national development.” However, the project's official X account has since been suspended, and its website is no longer accessible.

Phishing Links Found in Telegram and Data Aggregators A Telegram group that was linked to by major crypto data sites, including CoinGecko, was found to be hosting phishing links, according to Scam Sniffer, a cybersecurity company. The firm's founder, known as “Fun,” notified CoinGecko of the issue, which prompted the platform to remove the link.

The Telegram group featured a fake verification bot called “Safeguard,” which Scam Sniffer alleges was designed to pilfer information from unsuspecting users. Similar scams were reported in December, with phishing bots targeting crypto users via偽のセキュリティチェック.

The Telegram group was created on Feb. 3 and has about 2,000 subscribers. After days of silence, it only posted a brief message on Feb. 5: “ca soon.”

The phishing links were not limited to Telegram, with more suspicious links being found on other cryptocurrency aggregators. A security researcher from SlowMist, known as “Cos,” found a suspicious link on GMGNAI, a trading platform. The link, instead of leading to an official website, redirected users to a Linktree page. Among the links on the page was one that purported to lead to a livestream on the video platform Kick.

However, instead of a real livestream, users were directed to a fake CAPTCHA page that, when interacted with, triggered malicious code. The same Linktree URL was also shared in the Telegram group.

Crypto Aggregators May Be Enabling Scammers Many cryptocurrency data aggregators allow users to update token information, enabling individuals outside of a project's official team to alter details listed on major sites.

While this feature aims to provide up-to-date information, it also raises security concerns. According to cybersecurity expert Fun, scammers can initially list legitimate links, passing the review process, and later replace them with phishing links.

Doubt Over CAR Memecoin's Legitimacy The CAR memecoin garnered further attention when an X account purporting to belong to Félix Tshisekedi, the president of the Democratic Republic of Congo, responded to the announcement. The account posted:

When the whole world is watching the Super Bowl, African people are surviving. Hopefully crypto will help us to maintain our financial problems and give us a step for grow.

However, the account's username, @sadwraciborzu, appears to be unrelated to the DRC president. It was created in February 2025, and a verified account under Tshisekedi's name has been inactive since January 2020.

Moreover, an investigation suggests that President Touadéra's endorsement of the CAR memecoin may have been an AI-generated deepfake.