![\"Sample](\"https:\/\/media.kasperskycontenthub.com\/wp-content\/uploads\/sites\/43\/2023\/06\/30164051\/Phishing_targeting_hot_and_cold_cryptowallets_01.jpeg\")
<\/a>Sample phishing email that targets Coinbase users<\/p><\/div>\n
After the user clicks the link, they are redirected to a page where they are asked to enter their seed phrase. A seed phrase (recovery phrase) is a sequence of 12 (less commonly 24) words for recovering access to a crypto wallet. This is essentially the main password for the wallet. The seed phrase can be used for gaining or recovering access to the user’s account and making any transactions. The seed phrase cannot be changed or recovered: by misplacing it, the user risks losing access to their wallet for good, and by giving it to scammers, permanently compromising their account.<\/p>\n
<\/a>Seed phrase entry page<\/p><\/div>\n
If the user enters the seed phrase on a fake web page, scammers get full access to the wallet and the ability to siphon all of the funds to their own addresses.<\/p>\n
Fairly simple and devoid of software or social engineering tricks, scams like these typically target non-technical users. A seed phrase entry form usually has a stripped-down look: just an input field and a crypto exchange logo.<\/p>\n
Phishing scams that target cold wallets<\/h2>\n
A cold wallet (cold storage) is a wallet without a permanent connection to the internet, like a dedicated device or even just a private key written on a slip of paper. Hardware storage is the most common type of cold wallets. As these devices are offline most of the time, and remote access is impossible, users tend to store significantly larger amounts on these. That said, it would be erroneous to believe that a hardware wallet cannot be compromised without stealing it, or at least, getting physical access to it. As is the case with hot wallets, scammers use social engineering techniques to get to users’ funds. We spotted an email campaign recently that was specifically aimed at the owners of hardware cold wallets.<\/p>\n
This type of attack starts as a crypto email campaign: the user gets an email, addressed as being from the Ripple cryptocurrency exchange and offering to join a giveaway of XRP tokens, the platform’s internal cryptocurrency.<\/p>\n
Phishing letter pretending to be from the Ripple cryptocurrency exchange<\/em><\/strong><\/p>\n If the user clicks the link, they are presented with a blog page featuring a post that explains the rules of the “giveaway”. The post contains a direct link to “registration”.<\/p>\n Fake Ripple blog<\/em><\/strong><\/p>\n Already at this point, the scam shows a few differences from mass attacks on hot wallets: instead of sending the user a link to a phishing page, the scammers used a more sophisticated immersion trick with a blog post. They also went so far as meticulously copying the design of the Ripple website and registering a domain name that was nearly identical to the exchange’s official domain. This is called a Punycode<\/a> phishing attack. At first glance, the second-level domain is identical to the original one, but a closer look will reveal that the letter “r” has been replaced with a Unicode character that uses a cedilla<\/a>:<\/p>\n Also, the scam site is hosted in the .net top-level domain, rather than .com, where the official Ripple website is located. This may not raise any red flags with the victim, though, as both domains are widely used by legitimate organizations.<\/p>\n After the user follows the link from the “blog” to the fake Ripple page, they are offered to connect to the WebSocket address wss:\/\/s2.ripple.com.<\/p>\n Connection to the WebSocket address<\/p><\/div>\n Next, the user is offered to enter the address of their XRP account.<\/p>\n Entering XRP account address<\/em><\/strong><\/p>\n The website then offers to choose an authentication method for receiving the bonus tokens.<\/p>\n Choosing an authentication method<\/p><\/div>\n As you can see, hardware wallets are top of the list and suggested by scammers. Selecting Trezor redirects the user to the official website trezor.io, which allows to connect devices to web apps via Trezor Connect API. The API is used for simplifying transactions with the help of a hardware wallet. The scammers want the victim to connect to their website, so they can withdraw the funds from the victim’s account.<\/p>\n When the user attempts to connect to the third-party website, Trezor Connect asks them to consent to anonymous collection of data and to confirm that they want to connect to the website. The address of the scam site is displayed in a Punycode view as: https:\/\/app[.]xn--ipple-4bb[.]net. The scammer’s hope is that the user misses the address, which is provided in small print on the side of the page.<\/p>\n<\/a><\/p>\n<\/a><\/p>\nhttps:\/\/app[.]xn--ipple-4bb[.]net -> https:\/\/app[.]\u0157ipple[.]net\/<\/code><\/p>\n<\/a><\/a><\/p>\n<\/a>