New Phishing Attack Targets MetaMask Users for their Crypto Wallet Private Keys



New Phishing Attack Targets MetaMask Users for their Crypto Wallet Private KeysA new phishing campaign impersonates MetaMask, informs victims their cryptocurrency wallets aren’t “verified” and threatens suspension.

Cybercriminals will go wherever they a) perceive the money is and b) wherever they have expertise in the scam. In the case of the latest attack on MetaMask users identified by security researchers at Bitdefender Labs, the mastermind behind this attack certainly understands how MetaMask works.

In the scam, the potential victim user is sent an email impersonating MetaMask, asking for their wallet to be verified:

MetaMask scam

Those that click the “Verify My MetaMask” are taken to a phishing site made to look like MetaMask’s website. On the site, the victim is asked to provide their recovery phrase (a sequence of ten random words established when the wallet is setup that can be used to recover access to the wallet should the credentials be lost).

MetaMask Impersonation Scam

Once the recovery phrase is provided, it’s game over for the wallet owner, and funds are difficult to recover.

The key to the success of this campaign is found in the urgency it creates; the threat of suspending the wallet if it is not verified is enough to make unsuspecting recipients of this phishing email act accordingly and give up their most secret details about their MetaMask wallet.

This use of urgency is found in nearly every phishing scam – whether targeting individuals or users within an organization. And it’s only through having a vigilant mindset when receiving an email like the one above that will cause the recipient to pause and scrutinize the email to determine whether it’s legitimate or not before following the instructions found within. This vigilance is established in organizations through continual Security Awareness Training designed to not just teach users that scams are everywhere, but how they work, what role the user themselves plays in a phishing attack, and how they can stop the attack by simply paying attention.


Will your users respond to phishing emails?

KnowBe4's Phishing Reply Test (PRT) is a complimentary IT security tool that makes it easy for you to check to see if key users in your organization will reply to a highly targeted phishing attack without clicking on a link. PRT will give you quick insights into how many users will take the bait so you can take action to train your users and better protect your organization from these fraudulent attacks!

PRT-imageHere's how it works:

  • Immediately start your test with your choice of three phishing email reply scenarios
  • Spoof a Sender’s name and email address your users know and trust
  • Phishes for user replies and returns the results to you within minutes
  • Get a PDF emailed to you within 24 hours with the percentage of users that replied

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/phishing-reply-test

Topics: Phishing



Subscribe to Our Blog


Comprehensive Anti-Phishing Guide




Get the latest about social engineering

Subscribe to CyberheistNews