Hackers are minting their own crypto to use in elaborate phishing scams

(Image credit: Shutterstock / Wit Olszewski)

A new, elaborate fraud campaign involving airdropped tokens, a decentralized cryptocurrency exchange, and the MetaMask wallet has been spotted targeting naive cryptocurrency holders.

Airdropped tokens are tokens (or crypto coins) that the project’s developers distribute to the wider community. It is a common practice in the blockchain industry, as it allows participants to better acquaint themselves with the project, injects a solid amount into the circulating supply for easier trading, and raises awareness of the project. In exchange for airdropped tokens, users are often asked to provide their contact information, and share the news of the airdrop with friends on Twitter and other social channels.

A decentralized cryptocurrency exchange, or DeX, is essentially a computer program that connects two people willing to exchange cryptocurrencies. Unlike a centralized cryptocurrency exchange (CeX), which provides the liquidity and requires extensive KYC (Know Your Customer) processes, a DeX users are the ones providing liquidity and can be used anonymously.

A MetaMask wallet is a “hot” cryptocurrency wallet that comes in the form of a browser add-on. It’s used to store coins built on the Ethereum blockchain (ERC-20), and is one of the most popular cryptocurrency wallets out there.

Airdropping fake tokens

Now, Vice has reported a malicious group created their own coin, and airdropped it to an unknown number of MetaMask wallets. When the victim opens their wallet, they will see new and unknown coins costing roughly $30,000.

The coin itself is named after a website that claims to be a decentralized exchange, but is, in fact, a phishing site. There, the victims are invited to connect their MetaMask wallet in order to be able to exchange the coins for others, turning a profit in the process.

However, as soon as they connect their MetaMask wallet with the site, they’ve essentially given access to the attackers, and all of the funds stored there can be withdrawn.

So far, it’s unknown how many people fell for the scam.

These are the best identity theft protection services right now

Via: Vice

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.