Scammers reportedly stole $500,000 worth of cryptocurrencies over the past weekend using a new phishing attack that leverages Google Ads.
According to Check Point Research obtained by Engadget, the scammers purchased Google Ads placements for their websites while mimicking popular crypto wallets, including Phantom App and MetaMask.
The perpetrators designed the ads to mirror the URL of the original websites using domain names such as “phantonn.app,” which closely relates to the verified “phantom.app”.
Picks for you
The scammers then gained access to the victim’s passphrase once they visited the fake website and typed it in. Additionally, the scammers presented victims with a secret recovery phrase whenever they use the fake website to create a new wallet.
The scam was designed so that the victim uses the recovery phrase to log in into the scammers’ accounts who also became beneficiaries of the fraud.
Interestingly for MetaMask, the malicious website provided visitors with the option of importing an existing wallet in the process, giving the malicious actors access to the passphrase.
The amount stolen was significant considering that Phantom App and MetaMask are some of the most popular wallets supporting Solana and Ethereum.
The research indicates that the stolen amount was cross-referenced with Reddit forums, concluding that $500,000 was stolen. Notably, 11 wallet accounts containing crypto worth between $1,000 and $10,000 were also compromised. The funds have since been withdrawn.
Crypto space hit with more scams
This comes after several scams hit the cryptocurrency sector over the last few days. For example, a digital currency called Squid Token (SQUID) inspired by Netflix’s Squid Game launched in late October quickly skyrocketed but later turned out to be a scam.
At some point, the token hit the value of $2,860 per token Monday before losing all its value after the project’s unknown creators reportedly cashed out Squid tokens worth more than $3 million. At the same time, the project’s website, SquidGame.cash, is also inaccessible.
[coinbase]
