π¨ NEW PHISHING SCAM π¨
Already $650,000 stolen from a single individual and it's going to happen to a lot more people.
This is how it happened π§΅π
Already $650,000 stolen from a single individual and it's going to happen to a lot more people.
This is how it happened π§΅π
1/ On April 15th, @revive_dom received multiple text messages asking to reset his Apple ID password and at 6:32 PM he received a call from "Apple Inc." which was a spoofed caller ID.
They claimed that there was suspicious activity on his Apple ID and they asked for a one-time
They claimed that there was suspicious activity on his Apple ID and they asked for a one-time
2/ verification code to prove the owner of the Apple ID account. After giving the 6 digit verification code, the scammers hung up and his MetaMask wallet was wiped, with over $650,000 stolen. How did they access his MetaMask wallet? Let's look into what happened π
3/ MetaMask actually saves your seed phrase file on your iCloud. The scammers requested a password reset for the victim's Apple ID. After receiving the 2FA code, they were able to take control over the Apple ID, and access iCloud which gave them access to the victim's MetaMask.
Process of this attack:
1) Scammer requests random password resets to make the victim suspicious
2) Using a caller ID spoofer, the scammer will call the victim as Apple and claim there is suspicious activity on the account
1) Scammer requests random password resets to make the victim suspicious
2) Using a caller ID spoofer, the scammer will call the victim as Apple and claim there is suspicious activity on the account
3) The scammer will request a password reset for the victim's Apple ID
4) The scammer will ask the victim for the code, claiming it is to verify they are the real owner of the Apple ID, when in reality they are using that code to reset the victim's password
4) The scammer will ask the victim for the code, claiming it is to verify they are the real owner of the Apple ID, when in reality they are using that code to reset the victim's password
5) The scammer will have access to the victim's iCloud account, giving them free access to everything, including all the data MetaMask stores on iCloud
Total stolen:
132.86 ETH ($402,988 USD)
252,400 USDT
-----------------
$655,388
Total stolen:
132.86 ETH ($402,988 USD)
252,400 USDT
-----------------
$655,388
Key takeaways
- ALWAYS use a cold wallet to store your valuables
- Never give out verification codes to ANYONE
- Protect your information, don't give out your phone number or your personal email
- Caller information is easy to spoof. Companies like Apple will never call you
- ALWAYS use a cold wallet to store your valuables
- Never give out verification codes to ANYONE
- Protect your information, don't give out your phone number or your personal email
- Caller information is easy to spoof. Companies like Apple will never call you
Hereβs MetaMaskβs response to my thread, breaking down how the iCloud backup works. We all know how annoying it is constantly being asked to back up your phone or iCloud auto backing up itself, so they also provided a guide on how to turn it off π
https://twitter.com/MetaMask/status/1515727239391809536
β’ β’ β’
Missing some Tweet in this thread? You can try to
force a refresh
γ
