North Korean hackers linked to Lazarus Group are reportedly behind a massive phishing campaign targeting nonfungible token (NFT) investors.
SlowMist released a report on Dec. 24 revealing the tactics North Korean APT groups have used to defraud NFT investors, including decoy websites disguised as NFT-related platforms and projects.
Fake websites include one pretending to be a World Cup project and others imitating OpenSea, X2Y2, and Rarible.
SlowMist said decoy websites offered "malicious Mints" to trick victims into thinking they were minting a legitimate NFT by connecting their wallet to the website.
The NFT is fraudulent, and the hacker gains access to the victim's wallet.
Many phishing websites operated under the same Internet Protocol (IP), with 372 NFT phishing websites under one IP and 320 under another.
SlowMist says the phishing campaign has been ongoing for months, with the first domain name registered seven months ago.
Other phishing tactics included saving visitor data to external sites and linking images to target projects.
After obtaining the visitor's data, the hacker would run attack scripts on the victim, gaining access to their access records, authorizations, plug-in wallets, and sensitive data such as their approve record and sigData.
SlowMist said the analysis only looked at a small portion of the materials and extracted "some" of the North Korean hackers' phishing characteristics.
SlowMist noted that one phishing address gained 1,055 NFTs and 300 Ether, worth $367,000.
The same North Korean APT group was also behind the Naver phishing campaign Prevailion documented on March 15.
North Korea was involved in cryptocurrency theft in 2022.
North Korea stole $620 million in cryptocurrencies this year, according to South Korea's NIS.
Japan's National Police Agency warned crypto-asset businesses about North Korean hackers in October.
.png)
Comments
Post a Comment