<h2 id="header-0">Background</h2>On October 14, Twitter user Masiwei reported a malicious code targeting friend.tech for account theft.<img src="https://miro.medium.com/v2/resize:fit:700/0*Kw_53BiXYvXyCH_q" /><a href="https://twitter.com/0xmasiwei/status/1713188711243104467" rel="noopener noreferrer nofollow">https://twitter.com/0xmasiwei/status/1713188711243104467</a>According to the analysis by the SlowMist Security Team, the link sent by the attacker contained a malicious JavaScript script. The attacker would trick users into adding it as a bookmark, laying the groundwork for future malicious activities. Following this discovery, SlowMist issued a security warning on Twitter. The team had previously written an article about browser bookmark attacks, titled “SlowMist: Exposing How Malicious Browser Bookmarks Can Steal Your Discord Token.”<img src="https://miro.medium.com/v2/resize:fit:596/0*O3FMcqYfe7faRCi9" /><a href="https://twitter.com/SlowMist_Team/status/1713168236483584018" rel="noopener noreferrer nofollow">https://twitter.com/SlowMist_Team/status/1713168236483584018</a>On October 17, a user of friend.tech named Double Wan tweeted that their assets on friend.tech were stolen. The SlowMist Security Team immediately assisted the victim in tracking and investigating the theft. Through the efforts of the SlowMist team and the cooperation of OKX, the stolen funds were successfully intercepted. Below, we will detail the process of phishing attacks by fake journalists, hoping to raise awareness and help everyone better guard against such scams.<h2 id="header-1">Attack Process</h2>Disguising IdentityIn the digital world, one can easily fabricate their identity. The attacker masqueraded as a journalist from a well-known news agency and even had over ten thousand followers on Twitter.TargetingThe JavaScript malicious script was designed to attack friend.tech users. Naturally, the attacker chose Key Opinion Leaders (KOLs) as targets, who, due to their popularity, would find it reasonable to receive interview invitations.The attacker would follow people you are following on Twitter. When you visit the attacker’s Twitter page and see some mutual follows, it creates the impression that they are a part of the same community.Building TrustAfter scheduling an interview, the attacker would guide you to join the interview on Telegram and even provide an interview outline.<img src="https://miro.medium.com/v2/resize:fit:607/0*-C5uU8pQpU0zdjS4" /><a href="https://twitter.com/iamdoublewan/status/1714127044358066310" rel="noopener noreferrer nofollow">https://twitter.com/iamdoublewan/status/1714127044358066310</a><img src="https://miro.medium.com/v2/resize:fit:698/0*BZijrZjQXzy77jDj" /><a href="https://twitter.com/0xmasiwei/status/1713188713742876739" rel="noopener noreferrer nofollow">https://twitter.com/0xmasiwei/status/1713188713742876739</a>And so, you diligently prepare based on the interview outline provided by the attacker and engage in a two-hour interview, listening to two “hosts” conversing back and forth. It all seems legitimate, as you anticipate the interview being published on a renowned news website.The Moment of AttackAfter the interview, the attacker asks you to fill out a form and open a phishing link they provide. The link, under the “Verify” section, includes detailed explanations on why and how to verify: To prevent impersonation, you must verify the ownership of your friend.tech account. Please follow the instructions below to complete the verification process. To verify your friend.tech account, drag the “Verify” button to your bookmark bar, then go to the friend.tech website and click on the bookmark to verify.<img src="https://miro.medium.com/v2/resize:fit:700/0*cY_MkRMQnvqDZP3J" />Once a user opens the bookmark containing the malicious JavaScript script on the friend.tech page, the malicious code is designed to deceive and steal the user’s password (i.e., friend.tech’s 2FA), as well as the tokens associated with the embedded wallet Privy used by the friend.tech account. This means that both the user’s friend.tech account and the related funds are at risk of being stolen.<img src="https://miro.medium.com/v2/resize:fit:700/0*qFCSScXstbkZ0DEZ" /><a href="https://twitter.com/evilcos/status/1713164067358294293" rel="noopener noreferrer nofollow">https://twitter.com/evilcos/status/1713164067358294293</a><img src="https://miro.medium.com/v2/resize:fit:700/0*L-CE2wHb2wVQccZl" /><a href="https://twitter.com/evilcos/status/1713164067358294293" rel="noopener noreferrer nofollow">https://twitter.com/evilcos/status/1713164067358294293</a>Our founder, Cos, also emphasized the severity of such attacks. If your independent password, i.e., the 2FA for friend.tech, is stolen, and you have set up information related to friend.tech and its embedded wallet Privy (including other relevant information in localStorage), then your private key plaintext can also be stolen. This means that your account is effectively rendered useless unless friend.tech is willing to provide you with a new private key and corresponding wallet address.<img src="https://miro.medium.com/v2/resize:fit:700/0*GUN44xONBLr-ueYZ" /><a href="https://twitter.com/evilcos/status/1714237137829458335" rel="noopener noreferrer nofollow">https://twitter.com/evilcos/status/1714237137829458335</a><h2 id="header-2">Preventive Measures</h2>- Heighten awareness of social engineering attacks.- Avoid clicking on unknown links.- Learn basic methods to identify phishing links, such as checking for misspellings or extra punctuation in domain names, and ensuring they match official domains.- Install anti-phishing plugins, as detailed in our previous public articles, like “<a href="https://slowmist.medium.com/slowmist-how-to-choose-an-anti-phishing-plugin-6c30f2131ffb" rel="noopener noreferrer nofollow">How to Choose an Anti-Phishing Plugin</a>.”<h2 id="header-3">Summary</h2>Social engineering attacks and phishing scams are constantly evolving. The victim in this incident, who was just practicing English speaking skills, ended up having all their funds on friend.tech stolen. While we might not be familiar with all these scams, we can significantly avoid phishing attacks by: not clicking unknown links; learning to identify phishing links; and maintaining skepticism and continuous verification for actions involving authorization or password input. Lastly, we recommend reading SlowMist’s “Blockchain Dark Forest Self-Rescue Manual” available at: <a href="https://github.com/slowmist/Blockchain-dark-forest-selfguard-handbook/blob/main/README_CN.md." rel="noopener noreferrer nofollow">https://github.com/slowmist/Blockchain-dark-forest-selfguard-handbook/blob/main/README_CN.md.</a><h3 id="about-slowmist">About SlowMist</h3>SlowMist is a blockchain security firm established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Their goal is to make the blockchain ecosystem as secure as possible for everyone. They are now a renowned international blockchain security firm that has worked on various well-known projects such as Huobi, OKX, Binance, imToken, Crypto.com, Amber Group, Klaytn, EOS, 1inch, PancakeSwap, TUSD, Alpaca Finance, MultiChain, Cheers UP, etc.SlowMist offers a variety of services that include but are not limited to security audits, threat information, defense deployment, security consultants, and other security-related services. They offer AML (Anti-money laundering) software, Vulpush (Vulnerability monitoring) , SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) , Safe Staking and other SaaS products. They have partnerships with domestic and international firms such as Akamai, BitDefender, FireEye, RC², TianJi Partners, IPIP, etc.By delivering a comprehensive security solution customized to individual projects, they can identify risks and prevent them from occurring. Their team was able to find and publish several high-risk blockchain security flaws. By doing so, they could spread awareness and raise the security standards in the blockchain ecosystem.&#x1f4ac;<a href="https://www.slowmist.com/" rel="noopener noreferrer nofollow">Website</a> &#x1f426;<a href="https://twitter.com/SlowMist_Team" rel="noopener noreferrer nofollow">Twitter </a>⌨️<a href="https://github.com/slowmist/" rel="noopener noreferrer nofollow">GitHub</a>

Beware of Phishing Attacks by Fake Journalists

Table of Contents

SlowMist

Other articles published on Nov 14, 2023

Bitcoin Supply on the verge of asphyxiation Before 2024 Halving — Incoming Crash?

Ethereum Price Rises as BlackRock Applies for Spot ETF

Hong Kong-Listed Giant To Buy Bitcoin, Ether Worth $100 Million

Guide to Ensuring Safety at Web3 Events: Lessons from the ApeFest Incident

Chinese Company Announces It Will Invest $100 Million in Bitcoin and Ethereum!

Crypto.com Secures Key Dubai Licence: Expanding Virtual Asset Services

Join our free newsletter for daily crypto updates!