Web2 social engineering attacks &#8211; like <a href="https://halborn.com/what-is-phishing-attack-techniques-and-examples/">phishing</a> &#8211; are increasingly affecting users of Web3 services.&nbsp;We recently discovered an active phishing campaign targeting customers of crypto wallet service provider MetaMask. In this article, we’ll break down the various phishing techniques in the scam email we received on July 25, 2022, purporting to be from MetaMask.Here’s the email we received:&nbsp;&nbsp;<figure class="wp-block-image"><img decoding="async" src="https://lh6.googleusercontent.com/fTZpj4u602v60vuF1SBm-Zh_gryhhva1VUcHVo7ozQTwjepovPRTfLEIkBwRU0-ScuP5vgmyiLHq5qCsFD1uh8bndFuieqkHsme5dNUEOLUieIlN7UBpbuhVsA5RvMi5eLUlcuN-nrqmNprtHeQ" alt=""/></figure>If someone opens this email and looks at it rather quickly and superficially, it can easily pass as a real email from MetaMask. It features a subject line that references an open support ticket, it features the well-known MetaMask fox logo, and directs us to a clickable button with an innocuous, time-sensitive prompt: “Verify your wallet.”&nbsp;Upon closer inspection, however, we noticed a LOT of red flags:<h2>The Sender’s Email Address&nbsp;</h2>The sender’s name and email address features an egregious spelling error: Metamaks instead of MetaMask.&nbsp;<h2><img decoding="async" loading="lazy" src="https://lh4.googleusercontent.com/PqWvhdstWMi4JonSFzh3rj1rR4aMpx3Gh8I3gqFyDa9mvCyOiuQFO9i3quNcQ4SlmC2yq9fmMFZr9W4w3vHKAeEcjpW06PYa92aCojWuG56sfjsDagFTIDd__vyVGN6RrfNwnFlGrIWXp5iJwHU" height="417"></h2>The address is also not an official, real MetaMask domain. It’s a fake domain (metamaks.auction) and it’s the first real clue that we’re dealing with a malicious phishing campaign.&nbsp;Finally, if we open the other properties of the email, we can see that the server used to deliver the message (unicarpentry.onmicrosoft.com) is not related to the real service.&nbsp;<h2>Lack of Personalization in the Email</h2>If this was indeed a real email from a financial institution or a well-known wallet service like MetaMask, the email will contain a personalized message, with the real name of the recipient, some other ID information, and more clear instructions on what needs to be done.In this email, there is no personalization. We are not referred to by our name and there is no other kind of personalized account information in the email.&nbsp;&nbsp;<h2>The Redirected URL</h2>As a common rule, you should never click on any button or link that you received by email, SMS, WhatsApp, etc. Always verify the URL by moving your pointer over the button or link &#8211; before clicking on it! &#8211; to verify the URL address. The URL address will appear on the bottom left part of the browser, usually, when you hover over it.&nbsp;As we can see in this case, the domain we would enter if we were to have clicked on the “Verify your wallet” button has nothing in common with MetaMask. The domain reads: dockwo.com (and not MetaMask.com).&nbsp;<figure class="wp-block-image"><img decoding="async" src="https://lh6.googleusercontent.com/upIZa43XDD8IKpEvdgKDNZx0JMKYq6hWSlxPAioSxSK4xdtf3IaK7Cr81opMD0mViiRjvbybDE_EKZsSbl2DMm3uqFgaZAuxFOZYOhPSns5-r7X0_3GxQGHNa54FT5BeEH20tZ46j_9fjAv480I" alt=""/></figure><h2>The Fake Site</h2>Assuming you made the unfortunate mistake of missing all the red flags mentioned above and that you clicked on the “Verify your wallet” button, you would be directed to the following malicious website:&nbsp;<figure class="wp-block-image"><img decoding="async" src="https://lh4.googleusercontent.com/pkcB6oqyZT1OL1b2w1UBP7_MVZTSznc_LRzDyomMzkdWPFZSlNJVOJZXKjvKw2BabZLGdGUu9PV7t5fwR-DVuQmsxcnwmePe_UDpucDBqB0ssu-ibCQuopQptjm_gsr69tcJmi9vm3FgRoUr_jQ" alt=""/></figure>The domain is actually authorize-web.org, the usage of the known brand MetaMask is only under a subdomain of the registered TLD (Top Level Domain). As users, we always need to read the domain from right to left and check the “.” that splits the parts of the domain from the country or service indicator (.com , .es, .io, .com.br, etc.) and the brand or name itself.&nbsp;&nbsp;Even though this particular site has an SSL certificate (which tricks the user into thinking that it’s a secure place to transact), the only secure thing that will occur is that the user will send his/her passphrase for their wallet through a secure socket, but to a fake, illegitimate site.The scammer even tries to convince you that it’s watching out for your safety with phrases like: “Make sure no one is watching you right now, never share your passphrase with other people.”Once the victim enters the required passphrase, they are actually redirected to the real MetaMask website, which deceives the victim into thinking that everything is in order, but the truth is that the information of their crypto wallet was already exposed and now the scammers have all the information they need to access the victim’s digital assets.&nbsp;<h2>Final Considerations</h2>The best defense against phishing attacks like these is to stay vigilant when receiving emails and think twice before doing anything that seems a bit unusual or potentially suspicious.&nbsp;If an email contains a link to be clicked, visit the site directly instead and find the target page from there. If an attachment is unsolicited and seems suspicious, call the sender, and confirm before downloading or opening it.&nbsp;&nbsp;You can also activate 2FA or MFA in every account that you manage and use multilayer security solutions (and keep them updated!).No one can detect every phishing email, so it is important for companies to have processes in place for managing potential phishing attacks targeting their employees.&nbsp; An email security system can help to detect and block a potential phishing attack, and the use of multi-factor authentication can mitigate the impact of compromised credentials.In the event of a successful phishing attack targeting your employee, it is important to begin incident response as quickly as possible to minimize the damage to the company.&nbsp; Having a professional incident response team on-call can mean the difference between a devastating ransomware attack or data breach and a non-event.&nbsp;Contact the Halborn cybersecurity team at halborn@protonmail.com for more info on how we can help your organization prevent or mitigate phishing attacks.

MetaMask-Phishing-Campaign.jpg

Cybersecurity firm Halborn breaks down an active phishing email campaign targeting MetaMask crypto wallet users.

Warning: Active MetaMask Phishing Campaign

In this blog, we will try to shed some light on a new Coinbase phishing scheme that’s making its way around the globe with the scammers wanting to get the most information possible on their victims.It all begins with a simple email regarding a suspicious usage of the customer’s account:&nbsp;<figure class="wp-block-image"><img decoding="async" src="https://lh3.googleusercontent.com/X9axjYtO4Oj6B_IfvI9yFk6yN10WTywI3E4MqW4_zp1vDBwtnmcbA1qxG_f17HtmJTj-RtQp-dG4d_N_sI3Qbmh_CfUHl-OjjY2zaIkJJY-KNGDT2jcH5N90IP2O20ueWxvzTxan" alt=""/></figure>As we already <a href="https://halborn.com/what-is-phishing-attack-techniques-and-examples/">explained in a prior blog on phishing</a>, the scammers will use psychological techniques to trick the victim &#8211; what’s known as social engineering. The usual subjects tend to be things like urgent requests from financial institutions, unusual login access alerts, anything that could rush someone to perform the action where the scammer has the trap ready.With this Coinbase phishing example, the user should have noticed a couple of major red flags that would prevent them to fall into the hacker’s trap, such as the address of the email sender, the lack of personalization (user not referred to by name), the grammatical errors, and, most importantly, the suspicious link the soon-to-be phishing victim was being lured to click on.&nbsp; (Always remember to hover over links to see what address an email is leading you to before you actually click on it).&nbsp;<figure class="wp-block-image"><img decoding="async" src="https://lh5.googleusercontent.com/9RXVWUEWvcc5FkZNW-2Gv1lRlI5lB84TsagO1YnuNprs_4SoTDTyUKqcuDjbEWdVBJ7NJzxos8MSVfA6KLy92aBqfOlQrTMut41db_h-ywVnTVqfkvqPQ2ZHkXx1Coc5nTUEQ6c_" alt="Graphical user interface, text, application

Description automatically generated"/></figure>Let’s assume that we are the victim and that we clicked on that phishing link. Now what happens?Well, the first page that we will see looks like a real Coinbase webpage:<figure class="wp-block-image"><img decoding="async" src="https://lh4.googleusercontent.com/ybcURJLybiBIJII2PB3eaxuE46Gd-YlrP_Q64cNAx7_yVPsQSJGkUTt8TfmYvLcb0YhjRdTOOfxPJHPHdiwdXfgo_m4gkKcqlzdpuMLwQUDHA8Ovf4F5DF2CT79bxmR3vmDUnnaI" alt=""/></figure>At first sight, it appears that the scammers want to get access to the victims Coinbase credentials. But it doesn’t stop there. If we move even further along the phishing scam, we’ll find even more dangers when we see an alert that our account has been locked:&nbsp;<figure class="wp-block-image"><img decoding="async" src="https://lh3.googleusercontent.com/bC_agLeRJSpo2gtHaTm3gbHhXeNrR7_gBJDAPo9zx-yPZSW8HAjiSwcXjRrmzCxUlmLmYwkLvQS5FsCwTH4ZwKe-2M4t2iXqmjVJh_K6WAeYvSb_tH5f1Y9XD8aJlV2iJSCVejxp" alt=""/></figure>Of course, at this point, we &#8211; the victim &#8211; would have already released our credentials to the scammers, and so will be surprised to read that our accounts, and maybe our assets, are locked. So we click on “Verify my account.”&nbsp;<figure class="wp-block-image"><img decoding="async" src="https://lh4.googleusercontent.com/iuZDbQ9t_n-MFYRAxkc81_39i0S5fQ40XdQRLRVbB8BV_lHt__U0pTUgSpLzs1DDmYepKQ2sw4dTijye3ldBvWRjDnPjc4kuZhMDo-25AkAJ7SRiiHXMOj1GsBqG_15lMSCI_cyk" alt=""/></figure>On the next page, as you can see above, the cybercriminal will pursue even more personal data from its victims, who may miss more red flags: another grammatical error and a glaring typo: SIGNI instead of SIGN IN. Having missed those red flags and clicked on the “SIGNI” button, this would be the page the victim would see next:<figure class="wp-block-image"><img decoding="async" src="https://lh6.googleusercontent.com/akJW5KYivElRO3mz-e2fWKmIKszfiVl4Ygbd0disEU5SDf7-6mPamzPo4iPyfv7WR_d0aYxzgnR2k8cJBqkHpL7ZsdyO9wdpyZRBa746YpfsEyUcxieTi0BZ9St_HsGa0FsOEKEv" alt=""/></figure>As you can see, now is where the hacker can begin to do some real damage. They demand a lot of personal information. Information which they can then go on to use in what’s called a spear phishing attack, which is a kind of super-targeted phishing technique where the spear phishers pretend they’re a trusted source to convince victims to reveal confidential data, personal information, or other sensitive details.Of course, it doesn’t end here. The phishing attackers are just setting the stage for what’s behind the next page, the real jackpot: your credit card information.<figure class="wp-block-image"><img decoding="async" src="https://lh3.googleusercontent.com/EdvEOwdd7AqMIvnXR88mSFeJI51ZRj2LWYPefu0JXEf4Liea7bqi5IBqocA71GFmycW1BPUwSXmZZpJxqWk33Rjf10F5S-SlbdmksV17XdmF-zJ8xE9v-URxF8yVStEWxsD28iBk" alt=""/></figure>Once again, if the “Expired date” didn’t alert the victim to a scam going on, then you’d have freely given your credit card information, social security number and address to a hacker.&nbsp;The final coup de grace comes in the last page where the scammer requests your photo ID &#8211; front and back, of course! &#8211; for “identity verification” purposes.&nbsp;<figure class="wp-block-image"><img decoding="async" src="https://lh3.googleusercontent.com/tj8_mv03Ojw7kolU5wfhQ5gdB1Wo6cn_XXzlBHeh2bNXu6Ma63J2Y8PB3njqSshGWGIS-iHwolpKby6lXxvy6orEvOWmpy-uOXETV2tMoDsjYLkIM-Niov0AeNjSv1oTpYj2Vd45" alt=""/></figure>Armed with the ID photo of the victim, the scammers can now open all kinds of new accounts, credit cards, and loans, by impersonating their victims.After collecting all the information they want from the victim, the phishing site finally offers the victim a fake reassurance that their account was successfully verified:&nbsp;<figure class="wp-block-image"><img decoding="async" src="https://lh6.googleusercontent.com/h_f7FTuTcBO_53NyvyYm-fv1d1zX5U09juISDrYQaJ3yOHK4gUYpLj06IzYDvKR9mLaDLjZc4sio5KMyHYHMOsF4Tkxt4i4a5g_y53vcUcRCMk8vdU-giPUqsi_ILudxxpZOr_Hp" alt=""/></figure>And they’ll be promptly redirected to the real Coinbase site:<figure class="wp-block-image"><img decoding="async" src="https://lh4.googleusercontent.com/uGL4t65q84UnL0eq6hs-DIPWejKwxpiK0Kb8xLgBgCSFeQ9KEIpTbBbGuVxt-rMUppcGHnA-HAY66Z-5hGFVaRaqQXsvPpn8Ag80tsrvGxUNwWVz9-W_1__d_CEp3kcfOySya8Bx" alt=""/></figure>At this point, the innocent victim will enter their Coinbase credentials (which will work without a hitch this time), thinking that their locked account problem was solved, completely oblivious to the fact that they’ve just been scammed.<h2>Best Practices to Avoid Being the Victim of a Phishing Attack</h2>The best defense against phishing attacks is to stay vigilant and think twice before doing anything that seems a bit unusual or potentially suspicious. If an email contains a link to be clicked, visit the site directly instead and find the target page from there. If an attachment is unsolicited and seems suspicious, message the sender and confirm before downloading or opening it.&nbsp;&nbsp;If you think that you have received a phishing email, report it to the IT security team of the company the phishing email was impersonating so that they can investigate the phishing claim and respond if anyone else clicked on the email.No one can detect every phishing email, so it’s important for companies to have security processes in place for managing potential phishing attacks.&nbsp; An email security system can help to detect and block a potential phishing attack, and the use of multi-factor authentication can mitigate the impact of compromised credentials.In the event of a successful phishing attack, it’s imperative to begin incident response as quickly as possible to minimize the damage to the victim. If you’re an organization, having a professional incident response team on-call can mean the difference between a devastating ransomware attack or data breach and a non-event. Contact the Halborn cybersecurity team at halborn@protonmail.com for more info on how we can help your organization prevent or mitigate phishing attacks.

Coinbase-Phishing-Attacks.jpg

Cybersecurity firm Halborn gives a step-by-step dissection of a recent phishing attack that targeted Coinbase customers.

// Blog

Luis Lubeck

Articles