There’s no doubt that Web3 has improved the quality of lives globally. With each passing day, more people awake to countless opportunities in blockchain technology. As the bull run approaches, investors strategize to expand their portfolios and increase their assets. But while at it, everyone ought to be on high alert as Web3 still has security vulnerabilities like phishing scam attacks.

Fraudsters and con men in Web3 are unrelenting in their attempts. They try different ways to gain private information from investors, which they use to siphon their digital assets. The most recent attacks occurred on the 23rd of January, 2024. Unidentified hackers maliciously sent emails announcing unexpected airdrops through alleged email addresses of some crypto and web3 agencies. These firms include Token Terminal, Cointelegraph, De.Fi and WalletConnect.

The Sequence of Events

On the morning of the 23rd, WalletConnect, via its X account, informed the public of malicious emails being sent to their users from an email address linked to theirs. The circulated email contained a supposed link to receive an airdrop, which WalletConnect denies having any knowledge of. WalletConnect then warned its users not to interact with the email as they proceeded to investigate with Blockaid, a web3 security solutions company.

Shortly after, Cointelegraph discovered a similar email from their official address. The email contained a phishing link with an invite to partake in an airdrop in honor of the firm’s 10th anniversary. Once they caught wind of the affair, Cointelegraph’s team prevented this email from being sent to more users. The firm then alerted the public via X, giving a notice to be wary of the ongoing impersonation and to avoid clicking links sent by email or Direct Messaging.

Cointelegraph soon learned of a similar occurrence with WalletConnect and also contacted Blockaid. After this, reports came in from a crypto investigator, ZachXBT, with the information that besides WalletConnect and Cointelegraph, the scam attack was also linked to Token Terminal and De.Fi. He also flagged a multichain address that had gained over $580 of stolen crypto since the phishing emails were sent out.

The ongoing investigations to figure out how the hackers could send these emails from the official addresses of these web3 agencies soon yielded results. Hudson Rock, a cybersecurity company, released a report stating the discovery of cryptobot infostealer malware on a MailerLite employee's computer. This computer had access to sensitive URLs, corporate credentials, and cookies for Slack and Office365, which were used to collect private details.

Interestingly, MailerLite is the email service that all the affected websites use. According to Hudson Rock, the fraudster could access MailerLite’s servers through the malware, thus carrying out the phishing campaign. So, evidence suggests that MailerLite was exploited by an infostealer infection. Later, Blockaid published a report on X stating that the attackers leveraged a vulnerability in MailerLite to perpetuate the campaign, impersonating web3 companies and stealing over $600,000 from investors. Blockaid claimed that it protected its users from losing $2.7 million.

WalletConmect disclosed that the breach affected 117 customers through their pre-existing DNS records with MailerLite. WalletConnect ended its report by assuring customers that their safety remains a priority. De.Fi also related the scam attack to an issue with MailerLite announcing the transfer of their database to another service provider.

Token Terminal has also announced that they have disconnected their domain from MailerLite and deleted all subscriber information. They also announced their switch to another email provider and advised their customers to remain vigilant. Cointelegraph advised investors to be careful when interacting with emails containing announcements of unexpected airdrops. On that note, below are some useful tips.

How To Identify and Avoid Phishing Attacks

Web3 platforms still have certain vulnerabilities despite the increasing cybersecurity measures. While a solution to phishing scams and hacks is still in the works, you could safeguard yourself and your digital assets by observing the following.

Double-check all URLs and links before accessing them to avoid spoofing scams.
Conduct comprehensive research to ascertain the credibility of airdrops or other rewards before registering or clicking any links.
Check the SSL certificate of websites or use DNS security extensions to prevent spoofing.
Phishing can take the form of impersonation or social engineering, so verify all requests for sensitive information before divulging.
Avoid installing malicious browser extensions and regularly review the ones you have. Some extensions are a disguise for data theft tools.
Do not download digital wallets from third-party forums, as some are fraudulent.

All ventures come with risks. Nothing is entirely risk-free. So, the possibilities of phishing and other vulnerabilities shouldn’t discourage investors from investing in web3. Rather, it should alert them to the importance of always being cautious and employing the skill of careful observation before acting.