We have had many clients scammed over the last few months by different tactics, but all involved Proton Mail.
The first scammer was able to infiltrate a vendor’s email and extorted extra funds for “sending extra by mistake.” It appears that anyone who wrote that vendor could have been infected.
Then another hacker is copying the email addresses and menus, with 2 vendors being targeted so far. This is also Protonmail, and the giveaway is that one vendor’s name is misspelled, and both of these emails contained a different email adress next to the lock. That the email address that was a steroid forum. These emails contained red text. Make sure the 2 addresses are the same.
Now we have a third scammer who infiltrated a email conversation, then changed one letter in the vendor’s name that wasn’t easily identified, with the bitcoin address. This scammer asked for extra funds to double the order.
Please read any vendor emails very carefully. Make sure the email address is exactly the same as the vendor’s contact in every stage of contact. With some vendors who publish email addresses, check the bitcoin address.
So far this has affected only Protonmail. We had a similar problem in 2020-2021.
There’s a long thread about those hackers/scammers:
Thread 'Protonmail warning message'
https://drugbuyersguide.info/threads/protonmail-warning-message.6390/
Be safe and be careful! I will update this as more information becomes available.