Crypto Scammers Shift Gears, Target Social Media for Direct Attacks

Cryptocurrency-seeking attackers have shifted their focus to targeting users instead of platforms, using social media, including Twitter, to promote cryptocurrency scams and malware. In Q1 2024, over 1,500 fake accounts impersonating companies like zkSync and Inscribe were detected. Major social accounts, including the Securities & Exchange Commission and Mandiant, have also been compromised to promote fraudulent cryptocurrency offers.

Cryptocurrency Scammers Shift Tactics, Targeting Users Directly

Attackers Targeting Social Media Accounts for Cryptocurrency Scams

Sophisticated threat actors are increasingly targeting cryptocurrency users on social media, according to a recent study by cybersecurity firm Cyjax. The criminals are employing a mix of fake impersonator accounts and malware to promote fraudulent cryptocurrency offers and steal victims' funds.

In the first quarter of 2024, Cyjax detected 1,517 fake accounts on Twitter promoting cryptocurrency scams, with companies including zkSync, Inscribe, and Optimism being targeted for impersonation. More alarmingly, major social media accounts for the Securities & Exchange Commission and Mandiant were compromised and used to promote bogus cryptocurrency investment schemes.

Subtle Typosquatting and Link Redirection

One notable incident involved a fake account impersonating the well-known cryptocurrency trader "Ansem" on Twitter. The account used a subtle typosquatting technique to respond to tweets from the legitimate Ansem account, who had announced a presale of a new token called $BULL. The malicious account's link redirected victims to a "wallet drainer" website, designed to steal cryptocurrency assets. As a result, over $2.6 million was stolen, with one victim losing a staggering $1.2 million.

Enhanced Romance Scams and Phishing Attacks

Cyjax also reports a surge in "pig butchering" scams, a sophisticated type of romance scam that involves building trust with victims over time before urging them to invest in fraudulent cryptocurrency schemes. These scams have resulted in millions of dollars in losses for unsuspecting victims.

Phishing attacks have also become more prevalent, with attackers exploiting vulnerabilities in email service providers to impersonate web3 companies. In one such attack, a hacker stole over $600,000 by impersonating a legitimate web3 company and sending phishing emails to victims.

Drainer Malware on the Rise

Cyjax notes a concerning trend in the use of drainer malware by cryptocurrency phishing threat actors. This type of malware does not require the attacker to directly convince the victim to send funds. Instead, it only requires the victim to connect their cryptocurrency wallet to the malicious code, which then drains the victim's funds. In one instance, a victim lost 111.6 million ALI tokens, valued at approximately $4.3 million, due to this type of malware.

Prevention and Awareness

Cyjax emphasizes that user-oriented attacks have been a persistent threat to cryptocurrency users since the inception of digital currencies. However, recent market fluctuations and the ease with which scams can be carried out on platforms like Twitter have made these threats particularly prevalent in the first quarter of 2024.

To protect themselves, cryptocurrency users are urged to be wary of unsolicited offers or investment advice on social media. They should also be cautious when connecting their wallets to websites or services, particularly if they are prompted to do so through a link in an email or social media message.

Social media platforms have a responsibility to combat the proliferation of fraudulent accounts and malicious content. They should implement robust security measures and cooperate with law enforcement agencies to identify and shut down illicit activity.

By staying informed and exercising caution, cryptocurrency users can mitigate the risks of falling victim to these sophisticated scams.