{"id":69609,"date":"2024-01-23T09:18:31","date_gmt":"2024-01-23T13:18:31","guid":{"rendered":"https:\/\/coinscreed.com\/staging\/?p=69609"},"modified":"2024-01-23T09:18:33","modified_gmt":"2024-01-23T13:18:33","slug":"hackers-amass-over-580k-through-email-phishing-campaigns","status":"publish","type":"post","link":"https:\/\/coinscreed.com\/staging\/hackers-amass-over-580k-through-email-phishing-campaigns\/","title":{"rendered":"Hackers Amass Over $580K through Email Phishing Campaigns"},"content":{"rendered":"\n<p>Hackers have amassed over $580,000 from unsuspecting victims through an ongoing <a href=\"https:\/\/coinscreed.com\/staging\/the-security-implications-of-web3-infrastructure.html\" target=\"_blank\" rel=\"noreferrer noopener\">phishing and malware campaign<\/a> using email addresses that imitate those of prominent Web3 companies, such as Cointelegraph, WalletConnect, and Token Terminal.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img fetchpriority=\"high\" decoding=\"async\" width=\"795\" height=\"567\" src=\"https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2022\/01\/image-322.png\" alt=\"Hackers Amass Over $580K through Email Phishing Campaigns\" class=\"wp-image-17517\" srcset=\"https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2022\/01\/image-322.png 795w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2022\/01\/image-322-300x214.png 300w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2022\/01\/image-322-768x548.png 768w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2022\/01\/image-322-120x86.png 120w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2022\/01\/image-322-350x250.png 350w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2022\/01\/image-322-750x535.png 750w\" sizes=\"(max-width: 795px) 100vw, 795px\" \/><figcaption class=\"wp-element-caption\">Hackers Amass Over $580K through Email Phishing Campaigns<\/figcaption><\/figure>\n\n\n\n<p>As of the delivery of the phishing emails, cryptocurrency investigator ZachXBT has identified a multichain address that has accrued more than $580,000 worth of stolen cryptocurrency on his Telegram channel.<\/p>\n\n\n\n<figure class=\"wp-block-image size-jnews-featured-750\"><img decoding=\"async\" width=\"750\" height=\"513\" src=\"https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2024\/01\/image-104-750x513.png\" alt=\"\" class=\"wp-image-69611\" srcset=\"https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2024\/01\/image-104-750x513.png 750w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2024\/01\/image-104-300x205.png 300w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2024\/01\/image-104-768x525.png 768w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2024\/01\/image-104.png 943w\" sizes=\"(max-width: 750px) 100vw, 750px\" \/><figcaption class=\"wp-element-caption\">Screenshot of a phishing email from the ongoing campaign. Source: ZachXBT<\/figcaption><\/figure>\n\n\n\n<p>The address contains a variety of 280 distinct cryptocurrency tokens, with Ether comprising 86% of the wallet's holdings at the time of writing, or 227 ETH.<\/p>\n\n\n\n<p>Additionally, <a href=\"https:\/\/walletconnect.com\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">WalletConnect <span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><g id=\"wpil-svg-outbound-7-icon-path\" fill=\"none\" clip-path=\"url(#clip0_31_188)\">\r\n                            <path d=\"M9.16724 14.8891L20.1672 3.88908\" stroke-linecap=\"round\"\/>\r\n                            <path d=\"M13.4497 3.53554L20.5208 3.53554L20.5208 10.6066\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/>\r\n                            <path d=\"M17.5 13.5L17.5 16.26C17.5 17.4179 17.5 17.9968 17.2675 18.4359C17.0799 18.7902 16.7902 19.0799 16.4359 19.2675C15.9968 19.5 15.4179 19.5 14.26 19.5L7.74 19.5C6.58213 19.5 6.0032 19.5 5.56414 19.2675C5.20983 19.0799 4.92007 18.7902 4.73247 18.4359C4.5 17.9968 4.5 17.4179 4.5 16.26L4.5 9.74C4.5 8.58213 4.5 8.0032 4.73247 7.56414C4.92007 7.20983 5.20982 6.92007 5.56414 6.73247C6.0032 6.5 6.58213 6.5 7.74 6.5L11 6.5\" stroke-linecap=\"round\"\/>\r\n                        <\/g>\r\n                        <defs>\r\n                            <clipPath id=\"clip0_31_188\">\r\n                                <rect fill=\"white\" height=\"24\" width=\"24\"\/>\r\n                            <\/clipPath>\r\n                        <\/defs><\/svg><\/span><\/a>informed X (previously Twitter) users of its awareness regarding the fraudulent email that encourages recipients to click on the harmful airdrop link.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">We\u2019re aware of an email that appears to have been sent from an email address linked to WalletConnect prompting recipients to open a link to be able to claim an airdrop.<br><br>We can confirm that this email was not issued directly from WalletConnect or any WalletConnect affiliates, and\u2026 <a href=\"https:\/\/t.co\/bksAlMnWja\" target=\"_blank\">pic.twitter.com\/bksAlMnWja<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a><\/p>&mdash; WalletConnect (@WalletConnect) <a href=\"https:\/\/twitter.com\/WalletConnect\/status\/1749734325287858597?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">January 23, 2024<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<p>Users of the antivirus application De.Fi and <a href=\"https:\/\/coinscreed.com\/staging\/socialfi-and-gamefi-what-they-are-and-how-they-work.html\" target=\"_blank\" rel=\"noreferrer noopener\">Web3 SocialFi<\/a> are also the targets of an email that promotes the inauguration of a launchpad and contains a link to an airdrop. In addition, the assailants publicized a sham Token Terminal beta launch that included a claim icon for a simulated airdrop.<\/p>\n\n\n\n<p>The malicious actors employ email addresses that bear no resemblance to the legitimate addresses of the affiliated organizations in an attempt to deceive recipients into accepting them as authentic.<\/p>\n\n\n\n<p>Investors should exercise utmost caution when engaging with emails purporting to declare unforeseen airdrops.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hackers have amassed over $580,000 from unsuspecting victims through an ongoing phishing and malware campaign using email addresses that imitate those of prominent Web3 companies, such as Cointelegraph, WalletConnect, and Token Terminal. As of the delivery of the phishing emails, cryptocurrency investigator ZachXBT has identified a multichain address that has accrued more than $580,000 worth [&hellip;]<\/p>\n","protected":false},"author":12,"featured_media":17517,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[11476],"tags":[6115,6186,18015],"class_list":["post-69609","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hacks-and-scams","tag-hackers-2","tag-scam-2","tag-email-phishing-campaigns"],"jetpack_featured_media_url":"https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2022\/01\/image-322.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts\/69609","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/comments?post=69609"}],"version-history":[{"count":0,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts\/69609\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/media\/17517"}],"wp:attachment":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/media?parent=69609"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/categories?post=69609"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/tags?post=69609"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}