Guardio, a cyber security startup has uncovered a sophisticated phishing campaign targeting crypto and metaverse users using non-custodial wallets such as MetaMask.
Attackers Double Down on Phishing Campaigns
In their recent blog post, the Guardio research team noticed that the nefarious operation runs at full-throttle in breadth and depth. The cybersecurity startup picked out that hackers were using time-tested web infiltration tactics like domain typo-squatting techniques accelerated by malvertising campaigns where victims end up unknowingly approving payment to attackers via cloned websites of leading NFT and metaverse brands like OpenSea and more.
Typically, these NFT and metaverse websites offer a very high level of functionality and use a complex flow of wallet connections, primarily relying on non-custodial wallets, of which the most popular is MetaMask. Using black hat SEO and aggressively campaigning through paid Google AdWords, cloned and malicious websites are ranked on the first page of search results, subsequently funneling in thousands of victims.
Of note, the Guardiosaid these cloned websites, in their hundreds, are “flying under the radar” and cannot be detected by in-built browser protection mechanisms and traditional antivirus programs.
Why MetaMask and Metaverse
In their estimation, the Guardio research team says attackers have successfully accumulated thousands, if not hundreds of thousands of dollars, from susceptible victims, negatively impacting the user experience and subsequently giving the crypto and metaverse scene a bad rap.
Blockchain promises independence and total control. These are the principles adhered to by deploying agents and infrastructure providers. The MetaMask non-custodial wallet, for instance, is simple to use, allowing users across the board to store ETH, ERC-20, and other EVM-compatible tokens. It is estimated that over 10 million users actively used the wallet as an interface to various NFT, Metaverse, and DeFi portals in Ethereum, the Binance Smart Chain (BSC), Harmony, and other EVM-compatible networks.
Over the past few years, DeFi, NFT, and the Metaverse have expanded to command billions of dollars. When writing, all DeFi dApps locked over $208 billion. On the other hand, the NFT trading volumes in January 2022 alone soared to more than $5 billion, extending their impressive statistics in 2021. Last year, the total NFT trading volumes soared to over $25 billion. Meanwhile, despite attracting attention from Q3 2021, the Metaverse is gaining traction. According to estimates, the Metaverse will be revolutionary, overhauling the internet. In the next decade, analysts project the Metaverse’s valuation to rise to over $1 trillion.
Focus on Metaverse and Crypto Users
Attackers appear to be focused explicitly on the Metaverse, DeFi, and NFT crowd because most of them are tech-savvy and crypto holders. Aware that users are also on the lookout to prevent being hacked and losing precious assets, attackers are cloning and releasing a near-pixel copy of the original site, catching some users unawares.
Given the non-custodial operations of blockchain solutions, the controller of the wallet’s private keys must first confirm the transaction before it is irreversibly confirmed on the network. As such, by releasing a perfect front-end, attackers focus on getting the most out of, perhaps the only vulnerability in blockchain metaverse and NFT sites—end-user approval. Furthermore, Guardio researchers also noted that hackers have successfully extracted private keys, which are passphrases, needed for transaction confirmation.
Staying Safe in Crypto
Crypto innovations, including the Metaverse and NFTs, are exciting but still at nascence. Attackers are prowling and looking to extract funds and private keys at any moment from victims. To remain safe, due diligence is essential. Always use a reputable antivirus program as the first line of defense.
As a rule of thumb, never share your wallet’s private keys with anyone, no matter how convincing they are. Also, users should double-check to ensure they are visiting the actual website and not clones that usually have glaring typos.
