North Korean Advanced Persistent Threat (APT) hacker groups are behind massive NFT phishing scams. One of the hacker addresses even acquired 1,055 NFTs, selling them for a profit of almost 300 ETH, around $366k.
According to a Blockchain security firm SlowMist report, one of the methods employed in this phishing attempt was conducting malicious mints using NFT-related decoy websites.Â
The hackers created fake websites impersonating other NFT platforms like Rarible, X2Y2, and OpenSea to mislead users. The most recent phishing site that the hackers have set up and run pose are World Cup-related projects.
The North Korean APT used roughly 500 domain names to target users in its phishing attempt. The earliest registration date for these domain names was 7 months ago.
“thedoodles.site,” which was primarily utilized to record user data in the early stages of APT activities, is the primary domain name used by APT to monitor user requests.
Seven months ago, the HTTPS certificate for this domain name was registered, showing that the hacker group had already started concentrating on NFT users at that time.
In some host addresses, SlowMist discovered txt files with statistical data on victims and numerous attack scripts used by North Korean hackers. These files contained information about the victim’s authorizations, plug-in wallet usage, and access history.
Also Read:Â Lazarus Hackers target Developers via Fake Crypto.com Job Offers
According to SlowMist, there are groups of NFT phishing sites that share the same host’s IP address, with 372 of them sharing a single IP and another 320 sharing a different one.
In their phishing scams, the hackers used a variety of tokens, including WETH, USDC, DAI, UNI, etc. In addition, the hackers attempt to coerce their victims into doing Seaport and Permit signatures and engaging in other approving actions.
SlowMist’s report also revealed that North Korean hackers and Eastern Europe seem to be cooperating with phishing NFT users. Users, please beware of phishing scams and don’t click on any time of link without the necessary information about it!
Also Read:Â The 10 Most Common NFT Scams and Techniques to Avoid Them
