Phishers Earn $15,000 in Two Hours by Impersonating Legitimate Ethereum Wallet

Independent cybersecurity expert Wesley Neelen discovered an interesting phishing campaign that brought its operators over $15,000 in just a few hours. It all started when Neelen received a phishing email, supposedly from the administration of the real MyEtherWallet.com service. The message, shown below, claimed that the service was preparing for an upcoming hard fork and asked users to follow a link, unlock their account, and check their balance.

The link in the email led to a website that visually copied the real MyEtherWallet. Moreover, the attackers used Unicode characters, and if you look closely at the screenshot below, you can see that the letter “T” in the site’s address has a strange dot underneath. By using special characters, the attackers were able to register a domain that looked almost identical to the real MyEtherWallet.com.

If a victim fell for the scam and entered their credentials on the fake site, the criminals would immediately use this information to access the victim’s real wallet and withdraw all funds. Although Neelen quickly noticed the deception, he decided to study the malicious site more closely and soon discovered that some users were not as lucky as he was. With the help of a colleague, Neelen found a log on the site that contained data from all the wallets compromised by the scammers. It turned out that just one of the stolen wallets held 42.5 ETH, or about $12,500. Other wallets contained smaller amounts, but in total, the criminals’ “earnings” amounted to 52.56 ETH ($15,875) in just two hours.

At the end of his report, the expert sadly notes that the scammers’ site is hosted on so-called “bulletproof” hosting, so it’s unlikely that complaints will lead to the site being taken offline anytime soon.

Phishing Attacks Result in $225 Million in Stolen Cryptocurrency in 2017

It’s also worth noting that this year, cybercriminals have stolen $225 million worth of digital currency through phishing attacks. Scammers deceived potential investors in Ethereum-based token sales by luring them to fake web addresses. According to Chainalysis, more than 30,000 investors have fallen victim to Ethereum-related cybercrimes, with each losing an average of $7,500.

Jonathan Levin, co-founder of Chainalysis, says that cybercriminals are attracted by the huge profits earned by ICO organizers. In 2017 alone, token sales have already raised over $1.6 billion in funding.