Eight months before SpaceX filed its S-1, scammers were already building fake investment portals impersonating the company, Elon Musk, Fidelity, and Robinhood. By the time the IPO arrived, the campaign had reached 15 countries across five continents.
When SpaceX filed its S-1 in May 2026 ahead of a Nasdaq listing targeting a valuation of approximately $1.75 trillion, the event generated the kind of global investor attention that only a handful of companies have ever produced. It also generated something else: a coordinated, multi-channel impersonation campaign that had been building for the better part of a year.
Bitdefender Labs documented the full scope of the operation in a report published in early July 2026. Researchers traced the earliest activity to October 2025, when investment-themed scam emails promoting SpaceX and Starlink opportunities began appearing in inboxes. By December, SMS campaigns had expanded the operation’s reach. By March 2026, the same narrative was running simultaneously across email, text messages, social media advertisements, webinar-style promotions, and direct phone calls, a coordinated multi-channel effort targeting users in more than 15 countries across North America, Europe, Africa, Asia, and the Middle East. The intensity increased in step with the IPO timeline, reaching peak volume in June as the listing approached.
The campaign did not depend solely on the SpaceX name. It borrowed the identities of established financial brands to make the fraud feel like a legitimate investment process. Proofpoint tracked a related cluster under the designation TA2730, documenting attackers who used W-8BEN tax forms, a real IRS document that non-U.S. investors use to certify their foreign tax status, to create the appearance of a regulated onboarding workflow. Domains observed during the campaign included variations impersonating Fidelity, Robinhood, and Musk himself, each designed to look like a portal where an investor might reasonably expect to register for IPO access. The fraud funnel mirrored the real investment process: register, verify identity, select an investment tier, deposit funds. The final step directed victims to cryptocurrency wallets controlled by the operators.
How a financial event becomes an impersonation campaign
The SpaceX operation illustrates a pattern that extends well beyond any individual company or IPO.
Major financial events generate uncertainty alongside excitement. Retail investors who want to participate in a high-profile IPO often face genuinely confusing questions about eligibility, allocation, and process. That confusion is the attack surface. When the legitimate path to participation is complex and broker-mediated, a phishing page that simplifies the process, guides the user through familiar-looking steps, and asks for payment at the end does not register as fraudulent. It registers as helpful.
Bitdefender’s honeypot research captured this dynamic in real time. After researchers submitted contact information to a suspicious investment site, they received a 16-minute phone call from a caller promoting an AI-assisted investment platform tied to SpaceX. The caller referenced artificial intelligence, market analysis, and extraordinary weekly profits, then escalated to pressure tactics when the recipient hesitated. The pitch combined every element of modern social engineering: authority (SpaceX and Musk), urgency (the IPO is happening now), social proof (other investors are already participating), and fear of missing out (the window is closing). Each channel in the campaign served a distinct function: social media ads created awareness, emails built credibility, SMS created urgency, and phone calls attempted to close the sale.
The multi-channel approach is what distinguishes this from a simple phishing page. A victim who encounters the same narrative across an Instagram ad, an email, a text message, and a phone call experiences a level of consistency that reinforces the legitimacy of the offer. The brands being impersonated across those channels, from SpaceX to the financial institutions whose names appear on the fake portals, lend their authority to every touchpoint in the funnel without ever having authorized it.
The brands caught in the middle
The financial losses from this campaign fall on the individuals who deposited funds into wallets they will never recover. The reputational exposure extends to every brand whose identity was used to make the funnel convincing.
Fidelity and Robinhood appeared in the campaign not because either company was compromised but because their names represent trusted access to financial markets. A domain like fidelityspacexipo.site works as a lure precisely because Fidelity is the kind of institution an investor might expect to offer IPO access. The attacker does not need to breach the brand. They only need to borrow it, and the victim’s prior trust in the real institution does the rest.
This is the same dynamic documented in pig butchering campaigns where legitimate exchange interfaces are cloned to collect deposits, and in the broader crypto impersonation surge where Chainalysis tracked a 1,400% year-over-year increase in impersonation-driven scams. The SpaceX campaign adds a temporal dimension: the impersonation infrastructure was assembled months in advance, ramped in coordination with real news events, and reached peak intensity at the moment of maximum public attention. For any brand associated with a major financial event, the impersonation campaign is not a reaction to the event. It is planned alongside it.
Bitdefender’s observation that the campaign intensified even after the IPO completed, with operators promoting “final opportunities” and follow-up offers, confirms that the impersonation does not end when the event passes. It continues for as long as residual interest, confusion, or regret can be monetized, which means brand protection monitoring for the impersonated organizations needs to outlast the event itself.
The Bottom Line
The SpaceX IPO is the largest in history, and the impersonation campaign that accompanied it was proportionally ambitious: eight months of preparation, 15+ countries, five delivery channels, and the identities of some of the most recognized financial brands in the world borrowed without authorization. For the brands whose names appeared in the fake portals, the campaign is a reminder that any event generating significant public attention and financial uncertainty will produce a corresponding brand impersonation wave, and the infrastructure behind it will be in place before the event arrives.
Key Takeaways
Bitdefender Labs traced the earliest activity to October 2025, eight months before SpaceX filed its S-1. The campaign evolved across email, SMS, social media ads, webinars, and phone calls, reaching peak intensity in June 2026 as the listing approached.
SpaceX, Elon Musk, Fidelity, Robinhood, and other financial institutions. Domains mimicked legitimate investment portals, and fake W-8BEN tax forms created the appearance of a regulated onboarding process.
Social media ads created awareness, emails built credibility through investment reports and eligibility requests, SMS campaigns created urgency with countdowns and deadlines, and phone calls attempted to close the sale with direct pressure tactics. The consistency across channels reinforced the apparent legitimacy of the offer.
The impersonated brands did not authorize and may not have had visibility into how their names were being used across 15+ countries. The campaign demonstrates that any major financial event will generate a corresponding brand impersonation wave, and the infrastructure is built months in advance of the event itself.
Yes. Bitdefender and Proofpoint both frame the SpaceX campaign as a template that will be reapplied to future high-profile IPOs and financial events. Monitoring for newly registered investment-themed domains incorporating your brand name is the earliest detection opportunity.
