Gemini

Cybersecurity researchers have identified a new phishing toolkit dubbed CryptoChameleon, which targets employees of Coinbase, Binance, Gemini, and Kraken. 
A phishing campaign employing a new toolkit dubbed CryptoChameleon has emerged, targeting Federal Communications Commission (FCC) employees as well as staff of crypto companies like <a href="https://crypto.news/tag/coinbase/" target="_blank" rel="noreferrer noopener">Coinbase</a>, <a href="https://crypto.news/tag/binance/" target="_blank" rel="noreferrer noopener">Binance</a>, <a href="https://crypto.news/tag/Gemini/" target="_blank" rel="noreferrer noopener">Gemini</a>, <a href="https://crypto.news/tag/kraken/" target="_blank" rel="noreferrer noopener">Kraken</a>, ShakePay, and <a href="https://crypto.news/tag/trezor/" target="_blank" rel="noreferrer noopener">Trezor</a>. 
<figure class="wp-block-image size-full">
 <img loading="lazy" decoding="async" width="377" height="819" src="https://crypto.news/app/uploads/2024/03/ndslhfsdjf.jpeg" alt="Hackers target Coinbase, Binance staff with phishing clones of Gmail, iCloud - 26" class="wp-image-14254940">
 <figcaption class="wp-element-caption">
 Phishining clone of Coinbase sign in page | Source: Lookout
 </figcaption>
</figure> 
As <a href="http://www.lookout.com/threat-intelligence/article/cryptochameleon-fcc-phishing-kit?utm_source=hr7dcryptohdydotg9yenews83" target="_blank" rel="noreferrer noopener">reported</a> by analysts at cybersecurity firm Lookout, the attackers craft convincing single sign-on pages for Okta, a cloud service provider for authentication, resembling authentic ones. The multi-stage social engineering attack also involves emails, SMS, and voice phishing to trick the target into sharing usernames, passwords, password reset URLs and even photo IDs from victims, mostly located in the U.S., the firm says. 
<blockquote class="wp-block-quote"> 
 “This phishing kit first asks the victim to complete a captcha using hCaptcha. This is a novel tactic that prevents automated analysis tools from crawling and identifying the phishing site.” 
 Lookout 
</blockquote> 
 You might also like: <a href="https://crypto.news/myanmar-based-scammers-stole-100m-worth-of-crypto-since-2022-chainalysis-says/"> Myanmar-based scammers stole $100m worth of crypto since 2022, Chainalysis says </a> 
The phishing kit uses real-time interaction with victims, allowing customization of pages to include phone number digits, enhancing legitimacy. Analysis by Lookout revealed over 100 successful phishing attempts and ongoing phishing activity, primarily hosted on servers by Hostwinds, Hostinger, and Russia-based RetnNet. 
At the time of writing, neither Coinbase nor Binance, Kraken, or Gemini has released public statements regarding the matter. It also remains unclear whether the hackers have gained unauthorized access to private data. 
In January, analysts at the blockchain security firm SlowMist <a href="https://crypto.news/slowmist-reports-80-of-x-comments-related-to-phishing-software/" target="_blank" rel="noreferrer noopener">disclosed</a> that more than 80% of comments on publications of prominent projects on X were related to phishing software. According to the firm, scammers have been actively acquiring X accounts for fraudulent activities on Telegram, a popular cloud messaging platform, mainly targeting well-known crypto projects. 
 Read more: <a href="https://crypto.news/fake-airdrop-sms-to-kucoin-users-stir-data-leak-concerns/"> Fake airdrop SMS to KuCoin users stir data leak concerns </a>

Hackers target Coinbase, Binance staff with phishing clones of Gmail, iCloud

crypto.news

Other articles published on Mar 4, 2024

Bitcoin Surpasses $65,000; Pepe Emerges As Top Gainer

Unlock the Past: GGWP's Exclusive Presale Opportunity with Nostalgic Gaming Adventure

Memecoins SHIB, PEPE, FLOKI, and BONK Explode In Trading Volume, Soaring Over 3,000% In a Week

WOO Network (WOO) Price Prediction 2024, 2025, 2026-2030

Memecoin Market Explodes with Over 500% Surge in Prices and Trading Volume

Why Is Floki Up 326% Over A Week? Analyst Says 'Call It What You Want, But It Works'

Join our free newsletter for daily crypto updates!