Phishing Scams Target Users Of Crypto Data Tracking Websites With Malicious Ad

Phishing scams are not new in the digital space, and cybercriminals are increasingly employing them in the crypto space. For example, multiple reports on Friday have revealed that scammers targeted users of crypto data tracking platforms CoinGecko and Etherscan.

On Friday, CoinGecko, and Etherscan warned users against possible phishing exploits on their platforms. Consequently, both parties warned users against connecting their Metamask wallet to any popup on their website. Notably, shared screenshots revealed the scammers were attempting to deceive users with a false Bored Ape Yacht Club (BAYC) NFT giveaway. Etherscan tweeted:

“We’ve received reports of phishing popups via a 3rd party integration and are currently investigating. Please be careful not to confirm any transactions that pop up on the website,” adding “Interim we’ve taken immediate action to disable the said 3rd party integration on Etherscan.”

As first reported by Twitter user @Noedel19 and later confirmed by Etherscan and Coinzilla, the source of the exploit could be traced to Coinzilla Ads, a crypto ad network integrated by many crypto sites. Confirming the exploit, Coinzilla thanked users for their response and assured them that their team had taken care of the compromise.

Coinzilla reported that the popup originated from a single ad containing malicious code that managed to make it through their security checks. Moreover, the ad network noted that the campaign ran for less than an hour before their team took control of the situation. Coinzilla tweeted:

“A single campaign containing a piece of malicious code has managed to pass our automated security checks,” adding, “It ran for less than an hour before our team stopped it and locked the account.”

Coinzilla Take Steps To Improve Security In The Wake Of The Compromise

As part of their response to the attack, the crypto ad network revealed that they would beef up their security provisions due to the attack. Coinzilla revealed that in addition to technical improvements, it “will manually review and recreate all the creatives used by our clients” to ensure that no scammers embed malicious code in 3rd party scripts.

Additionally, the ad network says it will be working with all sites affected due to the exploit to support any user who may have lost digital assets due to the exploit while also committing to discover the culprits. The latest phishing scam represents the latest effort by scammers to profit from the hype around the BAYC ecosystem.

As previously reported by ZyCrypto, BAYC phishing scams have become popular since the launch of ApeCoin. Notably, just over two weeks ago, BAYC had reported that scammers had hijacked its Instagram account. While there have been no confirmed reports of users losing their digital assets to this latest exploit, unconfirmed sources say over 100 NFTs were lost in the Instagram hack.