One of the common tactics of such attackers is to offer to download the crypto drainer https://quarklab.ru/ source code or download the crypto drainer itself, disguising it as a useful and safe application.