Hackers created fake NFT marketplaces, projects, and a DeFi platform. North Korean hackers linked to Lazarus Group are reportedly behind a massive phishing campaign targeting nonfungible token (NFT) investors. SlowMist released a report on Dec. 24 revealing the tactics North Korean APT groups have used to defraud NFT investors, including decoy websites disguised as NFT-related platforms and projects. Fake websites include one pretending to be a World Cup project and others imitating OpenSea, X2Y2, and Rarible. SlowMist said decoy websites offered "malicious Mints" to trick victims into thinking they were minting a legitimate NFT by connecting their wallet to the website. The NFT is fraudulent, and the hacker gains access to the victim's wallet. Many phishing websites operated under the same Internet Protocol (IP), with 372 NFT phishing websites under one IP and 320 under another. SlowMist says the phishing campaign has been ongoing for months, with the first domain name r...