phishing
Просмотров: 79,025
31 обсуждают
Популярные
Новые
Según la empresa de seguridad Web3 Scam Sniffer, más de US$127 millones en #Criptomonedas fueron robados a inversores en el tercer trimestre de 2024, con aproximadamente US$46 millones perdidos en septiembre por ataques de phishing.
En los ataques de phishing, los estafadores engañan a los inversores para que vinculen sus billeteras cripto, como #MetaMask , a servicios fraudulentos. La vinculación de las billeteras cripto a sitios web de #phishing permite a los estafadores retirar #criptomonedas de los usuarios sin más autenticación.
En los ataques de phishing, los estafadores engañan a los inversores para que vinculen sus billeteras cripto, como #MetaMask , a servicios fraudulentos. La vinculación de las billeteras cripto a sitios web de #phishing permite a los estafadores retirar #criptomonedas de los usuarios sin más autenticación.
Twenty malicious #npm packages impersonating the #Hardhat #Ethereum✅ development environment have targeted private keys and sensitive data. These packages, downloaded over 1,000 times, were uploaded by three accounts using #typosquatting techniques to trick developers. Once installed, the packages steal private keys, mnemonics, and configuration files, encrypt them with a hardcoded AES key, and send them to attackers. This exposes developers to risks like unauthorized transactions, compromised production systems, #phishing , and malicious dApps.
Mitigation tips: Developers should verify package authenticity, avoid typosquatting, inspect source code, store private keys securely, and minimize dependency usage. Using lock files and defining specific versions can also reduce risks.
$ETH
Mitigation tips: Developers should verify package authenticity, avoid typosquatting, inspect source code, store private keys securely, and minimize dependency usage. Using lock files and defining specific versions can also reduce risks.
$ETH
Stay #SAFU on X and other socials.
@JasonYanowitz on X narrates his #hack odeal.
I got hacked yesterday. At the risk of looking foolish, I'll share how it happened so you can avoid this nightmare. For the past few weeks, people have been trying to get into my accounts. #Crypto accounts, email, twitter, etc... every few days I get an email that someone is trying to access one of my accounts. Thankfully I have non-text #2FA set up for everything so nothing got hacked. So when I got back from dinner last night and saw this email, I panicked.
Someone in North Cyprus had finally managed to hack into my account. I guess my security wasn't strong enough and they found a loophole.
I clicked the link to "secure my account". I entered my username and password, updated to a new password, and voila: I'm back in. Crisis averted. Or so I thought. Moments later, I got an email saying my email address had been changed.
This was the real hack.
I was now officially locked out of my account. So how did this happen? It turns out the original email, which looks incredibly real, was not so real. Most email clients hide the actual address.
But when you expand it, you can see that this email was sent from "verify@x-notify.com" Fake address. I got phished. Very foolish mistake. I don't open Google Docs when they're sent to me. I don't click links. I typically check addresses. But Friday 8pm after a long week, they got me. I am aware this thread exposes a pretty dumb mistake but if I can save one person from this same mistake, it's worth it.
Some takeaways:
- Don't click links
- If you do click a link, review the actual email address
- Set up non-text 2FA on everything
- If you've done that, trust your own security process
- If you think you've been hacked, slow down and think about how this could have happened
Big thank you to @KeithGrossman and some folks at X for helping me get my account back so quickly.
If you're still reading, go read the self-audit series from @samczsun.
And this best practices from @bobbyong.
Lot more you can do but start there. #phishing
@JasonYanowitz on X narrates his #hack odeal.
I got hacked yesterday. At the risk of looking foolish, I'll share how it happened so you can avoid this nightmare. For the past few weeks, people have been trying to get into my accounts. #Crypto accounts, email, twitter, etc... every few days I get an email that someone is trying to access one of my accounts. Thankfully I have non-text #2FA set up for everything so nothing got hacked. So when I got back from dinner last night and saw this email, I panicked.
Someone in North Cyprus had finally managed to hack into my account. I guess my security wasn't strong enough and they found a loophole.
I clicked the link to "secure my account". I entered my username and password, updated to a new password, and voila: I'm back in. Crisis averted. Or so I thought. Moments later, I got an email saying my email address had been changed.
This was the real hack.
I was now officially locked out of my account. So how did this happen? It turns out the original email, which looks incredibly real, was not so real. Most email clients hide the actual address.
But when you expand it, you can see that this email was sent from "verify@x-notify.com" Fake address. I got phished. Very foolish mistake. I don't open Google Docs when they're sent to me. I don't click links. I typically check addresses. But Friday 8pm after a long week, they got me. I am aware this thread exposes a pretty dumb mistake but if I can save one person from this same mistake, it's worth it.
Some takeaways:
- Don't click links
- If you do click a link, review the actual email address
- Set up non-text 2FA on everything
- If you've done that, trust your own security process
- If you think you've been hacked, slow down and think about how this could have happened
Big thank you to @KeithGrossman and some folks at X for helping me get my account back so quickly.
If you're still reading, go read the self-audit series from @samczsun.
And this best practices from @bobbyong.
Lot more you can do but start there. #phishing
#PeckShieldAlert
A #phishingscam address labeled "Fake_Phishing442897," which stole $55.4M in #DAI from a whale's account, has swapped 250K $DAI for 102.6 $ETH & transferred them to a new address 0x2751...fC12
The #phishing address currently holds ~$40.5m worth of cryptos, including ~15.18K $ETH , ~2.8M $DAI & ~327.3 $stETH
A #phishingscam address labeled "Fake_Phishing442897," which stole $55.4M in #DAI from a whale's account, has swapped 250K $DAI for 102.6 $ETH & transferred them to a new address 0x2751...fC12
The #phishing address currently holds ~$40.5m worth of cryptos, including ~15.18K $ETH , ~2.8M $DAI & ~327.3 $stETH
🚨#CyberSecurityAlert: There are now over 2,650 fake DeepSeek phishing sites, with a significant spike since Jan 26.
These sites trick users into revealing login credentials or buying virtual assets through misleading domains and interfaces.
Stay vigilant and double-check URLs! 🛑 #phishing #DeepSeek #CryptoScams
These sites trick users into revealing login credentials or buying virtual assets through misleading domains and interfaces.
Stay vigilant and double-check URLs! 🛑 #phishing #DeepSeek #CryptoScams
Important Update🏮
Check this post before you lose your funds.
As the bull market approaches, beware of the phishing scams currently taking place in the crypto world. Many fraudsters are using this market appreciation to send phishing emails and tokens to unsuspecting investors.
• What is a phishing scam?
Phishing scams are deceptive attempts to trick individuals into disclosing sensitive information such as usernames, passwords or financial details. These scams, usually perpetrated through fake emails, messages or websites, often impersonate legitimate organizations.
• What you need to do to avoid becoming a victim:
Don't click on unknown links and look for red flags in incoming messages, such as unusual return addresses, typos, or requests for sensitive information.
Verify the legitimacy of requests through official channels by adding additional layers of protection, such as two-factor authentication.
Don't try to sell random tokens or NFTs that appear in your wallet.
Have a dedicated phone or PC for trading and wallet related activities.
Remember: Your generous tips ❤️ will empower us to share more valuable content.
#HotTrends #Write2Earn #phishing #cryptoonline
Check this post before you lose your funds.
As the bull market approaches, beware of the phishing scams currently taking place in the crypto world. Many fraudsters are using this market appreciation to send phishing emails and tokens to unsuspecting investors.
• What is a phishing scam?
Phishing scams are deceptive attempts to trick individuals into disclosing sensitive information such as usernames, passwords or financial details. These scams, usually perpetrated through fake emails, messages or websites, often impersonate legitimate organizations.
• What you need to do to avoid becoming a victim:
Don't click on unknown links and look for red flags in incoming messages, such as unusual return addresses, typos, or requests for sensitive information.
Verify the legitimacy of requests through official channels by adding additional layers of protection, such as two-factor authentication.
Don't try to sell random tokens or NFTs that appear in your wallet.
Have a dedicated phone or PC for trading and wallet related activities.
Remember: Your generous tips ❤️ will empower us to share more valuable content.
#HotTrends #Write2Earn #phishing #cryptoonline
Цитируемый контент удален
Guaranteeing Privacy in Cryptocurrency with Lelantus Spark.
In a period where digital privacy is increasingly under threat, $FIRO emerges as a beacon of hope in the cryptocurrency landscape. FIRO has established itself as a top dog in blockchain privacy technology, offering users a secure and confidential means of conducting transactions.
At the heart of FIRO innovation lies Lelantus Spark, an advance privacy protocol that sets new standards in the ecosystem.
The Need for Privacy in Cryptocurrency
As the cryptocurrency market expands, so do the threats to user privacy. Phishing attacks, where malicious actors attempt to steal sensitive information by posing as legitimate entities, have become alarmingly common. These attacks often target wallets, exchanges, and even initial coin offerings, putting users' funds at risk.
In this context, privacy-focused cryptocurrencies like Firo play a crucial role in safeguarding users' financial information and transactions.
Lelantus Spark
Lelantus Spark, FIRO‘a advanced privacy technology, addresses these concerns head-on. This protocol offers several key advantages:
•Enhanced Anonymity: Lelantus Spark uses a unique one-out-of-many proofs system, making it virtually impossible to trace transactions back to their source.
•Scalability: The protocol is designed to handle a high volume of transactions efficiently, ensuring that privacy doesn't come at the cost of performance.
•User-Friendly: Despite its complex underlying technology, Lelantus Spark is designed with user experience in mind, making privacy accessible to all.
•Auditability: While providing strong privacy guarantees, Lelantus Spark also allows for optional auditability, striking a balance between privacy and regulatory compliance.
How Lelantus Spark Protects Against Phishing
Lelantus Spark's privacy features provide an additional layer of protection against phishing attacks. By obscuring transaction details and user identities, it significantly reduces the amount of useful information an attacker can gain, even if they manage to compromise a user's account.
The Future of Privacy with $FIRO
As digital threats evolve, so too must our defenses. FIRO’s commitment to ongoing research and development ensures that Lelantus Spark will continue to adapt and improve, staying ahead of potential vulnerabilities.
As we move forward in an increasingly connected world, technologies like Lelantus Spark will play a vital role in safeguarding our right to privacy. FIRO and its Lelantus Spark technology represent a significant leap forward in cryptocurrency privacy. By addressing the critical need for secure, private transactions, Firo is not just protecting individual users – it's helping to build a more vigorous and trustworthy cryptocurrency ecosystem for everyone.
#PrivacyMatters #phishing
At the heart of FIRO innovation lies Lelantus Spark, an advance privacy protocol that sets new standards in the ecosystem.
The Need for Privacy in Cryptocurrency
As the cryptocurrency market expands, so do the threats to user privacy. Phishing attacks, where malicious actors attempt to steal sensitive information by posing as legitimate entities, have become alarmingly common. These attacks often target wallets, exchanges, and even initial coin offerings, putting users' funds at risk.
In this context, privacy-focused cryptocurrencies like Firo play a crucial role in safeguarding users' financial information and transactions.
Lelantus Spark
Lelantus Spark, FIRO‘a advanced privacy technology, addresses these concerns head-on. This protocol offers several key advantages:
•Enhanced Anonymity: Lelantus Spark uses a unique one-out-of-many proofs system, making it virtually impossible to trace transactions back to their source.
•Scalability: The protocol is designed to handle a high volume of transactions efficiently, ensuring that privacy doesn't come at the cost of performance.
•User-Friendly: Despite its complex underlying technology, Lelantus Spark is designed with user experience in mind, making privacy accessible to all.
•Auditability: While providing strong privacy guarantees, Lelantus Spark also allows for optional auditability, striking a balance between privacy and regulatory compliance.
How Lelantus Spark Protects Against Phishing
Lelantus Spark's privacy features provide an additional layer of protection against phishing attacks. By obscuring transaction details and user identities, it significantly reduces the amount of useful information an attacker can gain, even if they manage to compromise a user's account.
The Future of Privacy with $FIRO
As digital threats evolve, so too must our defenses. FIRO’s commitment to ongoing research and development ensures that Lelantus Spark will continue to adapt and improve, staying ahead of potential vulnerabilities.
As we move forward in an increasingly connected world, technologies like Lelantus Spark will play a vital role in safeguarding our right to privacy. FIRO and its Lelantus Spark technology represent a significant leap forward in cryptocurrency privacy. By addressing the critical need for secure, private transactions, Firo is not just protecting individual users – it's helping to build a more vigorous and trustworthy cryptocurrency ecosystem for everyone.
#PrivacyMatters #phishing
🚨 Pérdida de $7.8 Millones en SolvBTC por Estafa de Phishing🚨
Un usuario ha perdido 7.8 millones de dólares en SolvBTC tras caer en una estafa de phishing. El incidente, detectado por Scam Sniffer, ocurrió en un lapso de 34 minutos, subrayando los riesgos de seguridad en el mundo de las criptomonedas. ¿Qué medidas adicionales crees que deberían implementarse para proteger a los usuarios de estas estafas? 🤔🔒💰
#Criptomonedas #SeguridadOnline #Phishing
$VET $VTHO $VANRY
Un usuario ha perdido 7.8 millones de dólares en SolvBTC tras caer en una estafa de phishing. El incidente, detectado por Scam Sniffer, ocurrió en un lapso de 34 minutos, subrayando los riesgos de seguridad en el mundo de las criptomonedas. ¿Qué medidas adicionales crees que deberían implementarse para proteger a los usuarios de estas estafas? 🤔🔒💰
#Criptomonedas #SeguridadOnline #Phishing
$VET $VTHO $VANRY
#PeckShieldAlert
The #phishing address that drained 55.4M $DAI has transferred 6,958.7 $ETH (worth ~$20m) to 10 addresses
The #phishing address that drained 55.4M $DAI has transferred 6,958.7 $ETH (worth ~$20m) to 10 addresses
What an #unlucky guy!
He got 275,700 $LINK ($4.42M) stolen by a #phishing #attack .
This guy accumulated 290,750 #LINK ($2.26M) at $7.8 from #exchanges between Jun 7, 2022, and Oct 14, 2023, a profit of nearly ~$2.4M currently.
Unfortunately, he accidentally clicked on the phishing link and was deceived into signing the approval transaction.
Ultimately, he lost a profit of $2.4M and a cost of $2.26M, a total loss of $4.66M!
He got 275,700 $LINK ($4.42M) stolen by a #phishing #attack .
This guy accumulated 290,750 #LINK ($2.26M) at $7.8 from #exchanges between Jun 7, 2022, and Oct 14, 2023, a profit of nearly ~$2.4M currently.
Unfortunately, he accidentally clicked on the phishing link and was deceived into signing the approval transaction.
Ultimately, he lost a profit of $2.4M and a cost of $2.26M, a total loss of $4.66M!
🚨 Phishing Attack Alert: $11.1M Lost in Recent Exploit! 🚨
Approximately 6 hours ago, a major phishing attack resulted in a significant loss of assets.
Details of the Exploit:
1⃣ 3,657 $MKR ($8,766,097) and 2.56M PT Ethena tokens ($2.4M) were stolen.
2⃣ The exploiter sold 3,657 MKR for 2,502 $ETH ($8,766,097), causing a 7.5% drop in the price of #MKR
3⃣ Additionally, 2.56M PT Ethena tokens were swapped for 689 ETH ($2.41M).
This incident highlights the critical importance of security in the crypto space. Always remain vigilant and take necessary precautions to protect your assets.
#Crypto #phishing #bitcoin #Binance $BNB
Approximately 6 hours ago, a major phishing attack resulted in a significant loss of assets.
Details of the Exploit:
1⃣ 3,657 $MKR ($8,766,097) and 2.56M PT Ethena tokens ($2.4M) were stolen.
2⃣ The exploiter sold 3,657 MKR for 2,502 $ETH ($8,766,097), causing a 7.5% drop in the price of #MKR
3⃣ Additionally, 2.56M PT Ethena tokens were swapped for 689 ETH ($2.41M).
This incident highlights the critical importance of security in the crypto space. Always remain vigilant and take necessary precautions to protect your assets.
#Crypto #phishing #bitcoin #Binance $BNB
🛑 STOP SCROLLING! WHY KYC CAN BE DANGEROUS!!! 🛑
⛔ Read the full post, as this is an important one:
"KYC is the act of throwing 99 innocent people under the bus in order to make law enforcement's job catching 1 bad guy a little easier. The 99 shouldn't tolerate it."
The picture shows what I recently found on Twitter.
Why should you care and what should/shouldn't you do?
Leaked KYC data makes you vulnerable to attacks like sim-swaps, which allow attackers to bypass your 2FA security, but also comes with even bigger danger.
Leaked documents can lead to scammers opening online bank accounts in your name, taking loans & putting you into a horrible financial situation.
Deepfakes and simple Epson printers with ID card printing features make it possible to even fake real-time online verification processes.
Conclusion:
Be EXTREMELY cautious where you submit your KYC information. If small, not properly secured projects require KYC for crypto allocations and similar, remember that you're making yourself vulnerable the moment you submit your data.
You can never be sure that your data is encrypted and saved in a secure spot. You just can NEVER be sure.... so IF you submit KYC data, make sure that you don't do it left, right, center wherever you go, but only provide big, trustworthy and well established companies with these kind of details.
You will thank me later.
Follow @Professor Mende - Bonuz Ecosystem Founder for more!
#scamalert #kyc #phishing #scams #hacking
$PEPE $FLOKI $SHIB
⛔ Read the full post, as this is an important one:
"KYC is the act of throwing 99 innocent people under the bus in order to make law enforcement's job catching 1 bad guy a little easier. The 99 shouldn't tolerate it."
The picture shows what I recently found on Twitter.
Why should you care and what should/shouldn't you do?
Leaked KYC data makes you vulnerable to attacks like sim-swaps, which allow attackers to bypass your 2FA security, but also comes with even bigger danger.
Leaked documents can lead to scammers opening online bank accounts in your name, taking loans & putting you into a horrible financial situation.
Deepfakes and simple Epson printers with ID card printing features make it possible to even fake real-time online verification processes.
Conclusion:
Be EXTREMELY cautious where you submit your KYC information. If small, not properly secured projects require KYC for crypto allocations and similar, remember that you're making yourself vulnerable the moment you submit your data.
You can never be sure that your data is encrypted and saved in a secure spot. You just can NEVER be sure.... so IF you submit KYC data, make sure that you don't do it left, right, center wherever you go, but only provide big, trustworthy and well established companies with these kind of details.
You will thank me later.
Follow @Professor Mende - Bonuz Ecosystem Founder for more!
#scamalert #kyc #phishing #scams #hacking
$PEPE $FLOKI $SHIB
🚨 Ataques a billeteras Solana: Los estafadores están utilizando dominios de terceros, como DAPPs vencidos, y explotando vulnerabilidades XSS para evadir las listas negras. Un robo reciente de más de 2,2 millones de dólares en activos de Solana resalta la creciente preocupación por la seguridad. Mantén siempre precauciones al conectar tu billetera. 🛑🔐 #Solana #CryptoSecurity #Phishing $SOL $PNUT
🚨_Crypto Scam Alert: August's Mixed Bag_🚨
August brought a rare glimmer of hope in the crypto scam landscape, with losses totaling a relatively low $4.8 million - the lowest since January 2021! 🙌 However, this progress is overshadowed by two terrifying phishing cases that cost users a staggering $293 million. 😱
The Good News:
After $10 million was returned to Ronin Network, August's losses were significantly lower than previous months. This is a step in the right direction, but we must remain vigilant.
The Bad News:
Two massive phishing scams shook the crypto community, resulting in devastating losses. These scams are a harsh reminder that vigilance is key when dealing with cryptocurrencies.
Stay Safe, Stay Informed:
Remember, knowledge is power. Stay up-to-date with the latest security measures and best practices to protect your assets.
Don't let scammers get the best of you!
#CryptoScamAlert #phishing #StaySafeCryptoFam #StayInformed
The Good News:
After $10 million was returned to Ronin Network, August's losses were significantly lower than previous months. This is a step in the right direction, but we must remain vigilant.
The Bad News:
Two massive phishing scams shook the crypto community, resulting in devastating losses. These scams are a harsh reminder that vigilance is key when dealing with cryptocurrencies.
Stay Safe, Stay Informed:
Remember, knowledge is power. Stay up-to-date with the latest security measures and best practices to protect your assets.
Don't let scammers get the best of you!
#CryptoScamAlert #phishing #StaySafeCryptoFam #StayInformed
¡Increíble pero cierto! 😱 Usuario pierde USD 32 millones en spWETH en un sofisticado ataque de phishing
En un golpe devastador para la comunidad cripto, un usuario perdió la asombrosa suma de USD 32 millones en tokens Spark Wrapped $ETH #Ethereum✅ (spWETH) debido a un sofisticado ataque de #phishing La víctima, cuya billetera termina en “e57”, fue engañado el 27 de septiembre, dejando su cartera completamente vacía de 12,083 tokens. 💔
Este incidente subraya la creciente amenaza de los ataques de phishing en el mundo de las #Criptomonedas donde los ciberdelincuentes emplean tácticas cada vez más avanzadas para robar fondos. ¡Mantente alerta y protege tus activos digitales! 🚨🔒
En un golpe devastador para la comunidad cripto, un usuario perdió la asombrosa suma de USD 32 millones en tokens Spark Wrapped $ETH #Ethereum✅ (spWETH) debido a un sofisticado ataque de #phishing La víctima, cuya billetera termina en “e57”, fue engañado el 27 de septiembre, dejando su cartera completamente vacía de 12,083 tokens. 💔
Este incidente subraya la creciente amenaza de los ataques de phishing en el mundo de las #Criptomonedas donde los ciberdelincuentes emplean tácticas cada vez más avanzadas para robar fondos. ¡Mantente alerta y protege tus activos digitales! 🚨🔒
🚨 IMPORTANT: Ledger Users Targeted in New Phishing Scam
Do you use a Ledger? If yes, you MUST read this!
A new wave of phishing emails is targeting Ledger users, posing a serious threat to cryptocurrency holdings. The scam attempts to trick users into activating a fake security feature called “Ledger Clear Signing,” claiming that action is required by October 31 to continue using their devices.
These emails — not sent from official Ledger addresses — direct recipients to a malicious link, urging them to activate the so-called security feature. The phishing email warns:
"To continue using your Ledger device securely, activating Clear Signing is mandatory starting November 1, 2024. This feature is essential in protecting your assets from phishing attacks and fraudulent activities that are becoming more sophisticated.”
These scam emails are well-disguised, playing on users’ fears of phishing attacks to ironically lure them into a phishing trap. Once users follow the link, they are prompted to share sensitive information, which scammers use to drain their accounts.
Stay Vigilant:
Do not click suspicious links or engage with emails not from official Ledger sources.
Never share your recovery phrase or personal information through any email or message.
Why Ledger Users Are a Prime Target:
Ledger hardware wallets are among the most trusted in the industry, making them prime targets for scammers. This “clean Ledger scam” was flagged by Thomas Roccia, a senior threat researcher at Microsoft, who confirmed that the phishing URL has no relation to Ledger.
Phishing attacks like these are becoming more sophisticated every day. Protect your assets by ensuring that you only use official communication channels and verify the authenticity of any request.
Stay safe, Ledger users! Like and share this, so people don't lose their money!
#LedgerSecurity #phishing #SCAMalerts #scam #warning
$PEPE $SHIB $FLOKI
Do you use a Ledger? If yes, you MUST read this!
A new wave of phishing emails is targeting Ledger users, posing a serious threat to cryptocurrency holdings. The scam attempts to trick users into activating a fake security feature called “Ledger Clear Signing,” claiming that action is required by October 31 to continue using their devices.
These emails — not sent from official Ledger addresses — direct recipients to a malicious link, urging them to activate the so-called security feature. The phishing email warns:
"To continue using your Ledger device securely, activating Clear Signing is mandatory starting November 1, 2024. This feature is essential in protecting your assets from phishing attacks and fraudulent activities that are becoming more sophisticated.”
These scam emails are well-disguised, playing on users’ fears of phishing attacks to ironically lure them into a phishing trap. Once users follow the link, they are prompted to share sensitive information, which scammers use to drain their accounts.
Stay Vigilant:
Do not click suspicious links or engage with emails not from official Ledger sources.
Never share your recovery phrase or personal information through any email or message.
Why Ledger Users Are a Prime Target:
Ledger hardware wallets are among the most trusted in the industry, making them prime targets for scammers. This “clean Ledger scam” was flagged by Thomas Roccia, a senior threat researcher at Microsoft, who confirmed that the phishing URL has no relation to Ledger.
Phishing attacks like these are becoming more sophisticated every day. Protect your assets by ensuring that you only use official communication channels and verify the authenticity of any request.
Stay safe, Ledger users! Like and share this, so people don't lose their money!
#LedgerSecurity #phishing #SCAMalerts #scam #warning
$PEPE $SHIB $FLOKI
(@sell9000 )
PSA re: an expensive opsec lesson
At this time I have confirmed that it was a Google login that caused this compromise. An unknown Windows machine gained access about half a day before the attack. It also spoofed the device name, so the notification of the new activity alert (which occurred early morning while I was asleep) appeared similar to devices I normally use (it may have been a calculated gamble for a common device name unless I was specifically targeted).
Upon further investigation, this device is a VPS hosted by #KaopuCloud as a global edge cloud provider that is shared among hacker circles in Telegram, and has been used in the past for #phishing and other malicious activities by shared users.
I do have 2FA enabled, which the user managed to bypass. I have yet to determine exactly how this was achieved, but possibly attack vectors were OAuth phishing, cross site scripting, or man-in-the-middle attack on a compromised site, followed by possible additional #Malware . In fact, apparently #OAuth endpoint attack recently has been reported to hijack user cookie session (https://darkreading.com/cloud-security/attackers-abuse-google-oauth-endpoint-hijack-user-sessions…). Be extremely careful if you have to use Sign In From Google.
Takeaways:
1. Bitdefender sucks, it caught nothing while Malwarebytes caught a bunch of vulnerabilities after the fact.
2. Do not become complacent just because you were moving large figures for years without issues.
3. Never enter a seed, period, no matter what reasonable excuse you give yourself. Not worth the risk, just nuke the computer and start fresh.
4. I'm done with Chrome, stick with a better browser like Brave.
5. Preferably never mix devices, and have an isolated device for crypto activities.
6. Always check the Google Activity alert if you are continuing to use Google based devices or authentication.
7. Turn off extension sync'ing. Or just turn off sync'ing period for your isolated crypto machine.
8. 2FA is clearly not bulletproof, don't become complacent to it.
PSA re: an expensive opsec lesson
At this time I have confirmed that it was a Google login that caused this compromise. An unknown Windows machine gained access about half a day before the attack. It also spoofed the device name, so the notification of the new activity alert (which occurred early morning while I was asleep) appeared similar to devices I normally use (it may have been a calculated gamble for a common device name unless I was specifically targeted).
Upon further investigation, this device is a VPS hosted by #KaopuCloud as a global edge cloud provider that is shared among hacker circles in Telegram, and has been used in the past for #phishing and other malicious activities by shared users.
I do have 2FA enabled, which the user managed to bypass. I have yet to determine exactly how this was achieved, but possibly attack vectors were OAuth phishing, cross site scripting, or man-in-the-middle attack on a compromised site, followed by possible additional #Malware . In fact, apparently #OAuth endpoint attack recently has been reported to hijack user cookie session (https://darkreading.com/cloud-security/attackers-abuse-google-oauth-endpoint-hijack-user-sessions…). Be extremely careful if you have to use Sign In From Google.
Takeaways:
1. Bitdefender sucks, it caught nothing while Malwarebytes caught a bunch of vulnerabilities after the fact.
2. Do not become complacent just because you were moving large figures for years without issues.
3. Never enter a seed, period, no matter what reasonable excuse you give yourself. Not worth the risk, just nuke the computer and start fresh.
4. I'm done with Chrome, stick with a better browser like Brave.
5. Preferably never mix devices, and have an isolated device for crypto activities.
6. Always check the Google Activity alert if you are continuing to use Google based devices or authentication.
7. Turn off extension sync'ing. Or just turn off sync'ing period for your isolated crypto machine.
8. 2FA is clearly not bulletproof, don't become complacent to it.
Anti-phishing code🛡
Do not reveal your password or verification codes to anyone, including Binance Support.🛡
#phishing
Do not reveal your password or verification codes to anyone, including Binance Support.🛡
#phishing
Войдите, чтобы посмотреть больше материала