Hackers linked to North Korea\u2019s Lazarus Group are reportedly behind a massive phishing campaign targeting nonfungible token (NFT) investors \u2014 utilizing nearly 500 phishing domains to dupe victims.<\/p>\n
Blockchain security firm SlowMist released a report on Dec. 24, revealing<\/a> the tactics that North Korean Advanced Persistent Threat (APT) groups have used to part NFT investors from their NFTs, including decoy websites disguised as a variety of NFT-related platforms and projects.<\/p>\n Examples of these fake websites include a site pretending to be a project associated with the World Cup, as well as sites that impersonate\u00a0well-known NFT marketplaces<\/a>\u00a0such as OpenSea, X2Y2 and Rarible.<\/p>\n SlowMist said one of the tactics used was having these decoy websites offer \u201cmalicious Mints,\u201d which involves deceiving the victims into thinking they are minting a legitimate NFT by connecting their wallet to the website.<\/p>\n However, the NFT is actually fraudulent, and the victim\u2019s wallet is left vulnerable to the hacker who now has access to it.<\/p>\n The report also revealed that many of the phishing websites operated under the same Internet Protocol (IP), with 372 NFT phishing websites under a single IP and another 320 NFT phishing websites associated with another IP.<\/p>\n SlowMist said the phishing campaign has been ongoing for several months, noting that the earliest registered domain name came about seven months ago.<\/p>\n Other phishing tactics used included recording visitor data and saving it to external sites as well as linking images to target projects.<\/p>\n After the hacker was about to obtain the visitor’s data, they would then proceed to run various attack scripts on the victim, which would allow the hacker access to the victim\u2019s access records, authorizations and use of plug-in wallets, as well as sensitive data such as the victims\u2019 approve record and sigData.<\/p>\n All this information then enables the hacker access to the victim\u2019s wallet, exposing all their digital assets.<\/p>\n However, SlowMist emphasized that this is just the \u201ctip of the iceberg,\u201d as the analysis only looked at a small portion of the materials and extracted \u201csome\u201d of the phishing characteristics of the North Korean hackers.<\/p>\n SlowMist Security Alert<\/p>\n North Korean APT group targeting NFT users with large-scale phishing campaign<\/p>\n This is just the tip of the iceberg. Our thread only covers a fraction of what we’ve discovered.<\/p>\n Let’s dive in pic.twitter.com\/DeHq1TTrrN<\/a><\/p>\n \u2014 SlowMist (@SlowMist_Team) December 24, 2022<\/a><\/p><\/blockquote>\n For example, SlowMist highlighted that just one phishing address alone was able to gain 1,055 NFTs and profit 300 Ether (ETH<\/a>), worth $367,000, through its phishing tactics.<\/p>\n It added that the same North Korean APT group was also responsible for the Naver phishing campaign that was previously\u00a0documented<\/a> by Prevailion on March 15.<\/p>\n Related:<\/em><\/strong> <\/em><\/strong>Blockchain security firm warns of new MetaMask phishing campaign<\/em><\/strong><\/a><\/p>\n North Korea has been at the center of various cryptocurrency theft crimes in 2022.<\/p>\n According to a news report published by South Korea\u2019s National Intelligence Service (NIS) on Dec 22, North Korea stole $620 million<\/a> worth of cryptocurrencies this year alone. <\/p>\n In October, Japan\u2019s National Police Agency sent out a warning to the country\u2019s crypto-asset businesses advising them to be cautious of the North Korean hacking group.<\/a> <\/u> <\/p>\n<\/div>\n![](\"https:\/\/s3.cointelegraph.com\/uploads\/2022-12\/85ca2b0c-8c28-4c86-bc64-3e0d7eaa231c.PNG\")
\n