{"id":68343,"date":"2024-01-05T17:27:53","date_gmt":"2024-01-05T21:27:53","guid":{"rendered":"https:\/\/coinscreed.com\/staging\/?p=68343"},"modified":"2024-01-05T17:27:56","modified_gmt":"2024-01-05T21:27:56","slug":"forbes-impersonator-hacks-certiks-x-account-in-phishing-scam","status":"publish","type":"post","link":"https:\/\/coinscreed.com\/staging\/forbes-impersonator-hacks-certiks-x-account-in-phishing-scam\/","title":{"rendered":"Forbes Impersonator Hacks CertiK’s X Account in Phishing Scam"},"content":{"rendered":"\n

According to an X post from CertiK on January 5, a phishing scammer impersonating a Forbes reporter temporarily accessed the X (previously Twitter) account of the blockchain security<\/a> platform CertiK and used it to promote a malicious Web3 application.<\/p>\n\n\n\n

\"Forbes
Forbes Impersonator Hacks CertiK's X Account in Phishing Scam<\/figcaption><\/figure>\n\n\n\n

One of our employees received communication from a verified account affiliated with a reputable media organization. This employee was, unfortunately, the target of a phishing attack after the compromise of this account.<\/p>\n\n\n\n

\n

A verified account, associated with a well-known media, contacted one of our employees. Unfortunately, it appears that this account was compromised, leading to a phishing attack on our employee.

We quickly detected the breach and deleted the related tweets within minutes. Our\u2026 pic.twitter.com\/aO7GQjXEz2\r\n \r\n \r\n \r\n <\/g>\r\n \r\n \r\n \r\n <\/clipPath>\r\n <\/defs><\/svg><\/span><\/a><\/p>— CertiK (@CertiK) January 5, 2024<\/use><\/svg><\/span><\/a><\/blockquote>

According to the post, a verified account associated with a well-known media outlet contacted one of our employees. The post asserted that the compromise of the account led to the employee being phished and “related tweets” being published to the account.<\/p>\n\n\n\n

At this time, the malicious messages have been removed. On January 5, the blockchain security platform Cyvers <\/use><\/svg><\/span><\/a>asserted in a post to X that it had observed the purged messages before their removal. <\/p>\n\n\n\n

Per their assertions, the communications declared the compromise of Uniswap's router and instructed recipients to cancel all authorizations for Uniswap by utilizing Revoke.cash. It resulted in a rogue version of Revoke.cash attempting to steal users' cryptocurrency.<\/p>\n\n\n\n

\n

\ud83d\udea8ALERT\ud83d\udea8We are seeing reports that @CertiK<\/use><\/svg><\/span><\/a>'s X account has been compromised!

Do NOT click any links promoted! #CyversAlert<\/use><\/svg><\/span><\/a> pic.twitter.com\/4M3JNNaJ53<\/use><\/svg><\/span><\/a><\/p>— \ud83d\udea8 Cyvers Alerts \ud83d\udea8 (@CyversAlerts) January 5, 2024<\/use><\/svg><\/span><\/a><\/blockquote>

According to CertiK, the team promptly initiated a recovery procedure to revoke the attacker's access to its X account within seven minutes of their publication after discovering the malicious communications. <\/p>\n\n\n\n

The group was able to remove the initial negative post within fourteen minutes. The team achieved success in neutralizing the threat 37 minutes into the investigation.<\/p>\n\n\n\n

CertiK asserted that the fraud was a component of “an ongoing, large-scale attack” comparable to the one X user NFT_Dreww.eth described in a December 21 post. <\/p>\n\n\n\n

The attacker posed as a Forbes reporter and instructed victims to link their X accounts to the Calendly calendar app to arrange a meeting, as described in the NFT_Dreww.eth account for the phishing scheme<\/a>. <\/p>\n\n\n\n

The hyperlinks could have led to the official website of Calendly. In lieu of that, they visited a fraudulent Calendly site that featured a misspelled URL. Unknowingly granting the assailant permission to publish content on behalf of the victim on X, they “connected” their X account to the fraudulent website.<\/p>\n\n\n\n

ZachXBT, an on-chain investigator, purportedly attached a screenshot of the deceptive message that CertiK received in response to CertiK's post. The message appears to originate from an imposter posing as Mark Beech, a deceased former contributor to Forbes and Bloomberg who passed away in 2020.<\/p>\n\n\n\n

ZachXBT inquired in their post whether CertiK would reimburse victims who came into contact with phishing attempts due to the deceptive post to CertiK's account. CertiK issued the following statement in response: “We urge all individuals impacted by the recent Twitter incident to contact us.”<\/p>\n\n\n\n

Phishing attempts in the last fortnight have compromised several prominent crypto X accounts. On December 29, a breach occurred on the Compound Finance account. Equally affected on January 4 was the proprietor of Polychain Capital<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

According to an X post from CertiK on January 5, a phishing scammer impersonating a Forbes reporter temporarily accessed the X (previously Twitter) account of the blockchain security platform CertiK and used it to promote a malicious Web3 application. One of our employees received communication from a verified account affiliated with a reputable media organization. […]<\/p>\n","protected":false},"author":1,"featured_media":68384,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[11476],"tags":[6357,17780,8194,17779],"class_list":["post-68343","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hacks-and-scams","tag-certik","tag-forbes-impersonator","tag-phishing-attack","tag-x-account"],"jetpack_featured_media_url":"https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2024\/01\/image-37.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts\/68343","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/comments?post=68343"}],"version-history":[{"count":0,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts\/68343\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/media\/68384"}],"wp:attachment":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/media?parent=68343"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/categories?post=68343"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/tags?post=68343"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}