Korean hackers stealing NFTs via fake OpenSea like websites

North Korean hackers are targeting NFTs traders via more than 500 phishing websites.

North Korea is a Crypto supportive country. Perhaps Korean citizens are not allowed to use the internet, Crypto & blockchain focussed services but North Korea’s supreme leader Kim Jong-un loves cryptocurrencies. Many reports claimed that Korea-backed hackers stole cryptocurrency to fund Korean weapon programs. 

On 24 Dec, SlowMist, a blockchain security platform, published a report and noted that hackers from North Korea’s Advanced Persistent Threat (APT) group are actively targeting the NFTs traders.

SlowMist Security Alert

North Korean APT group targeting NFT users with large-scale phishing campaign

This is just the tip of the iceberg. Our thread only covers a fraction of what we've discovered.

Let's dive in pic.twitter.com/DeHq1TTrrN

— SlowMist (@SlowMist_Team) December 24, 2022

Report noted that hackers are using more than 500 phishing websites, which are much similar to popular NFTs trade platforms like OpenSea, X2Y2, and Raible, etc. NFTs traders usually come to these fake/clone websites & disclose their wallet login details.

These Hackers usually pretend to the NFTs users that he was minting real NFTs perfectly & also he was connecting the wallet to the real marketplace website smoothly under a systematic process. After the completion of such steps, the hacker accesses the crypto wallet of the NFTs users/traders. 

SlowMist noted that scammers & hackers are actively facilitating their illegal activities for many months because the registered phishing domain names were registered 7 months ago. 

This blockchain security team noted that reported investigation is only a small part of such scams and these hackers are doing something big to scam & hack people’s crypto wallets easily.

Earlier this, Microsoft warned the Crypto community to remain away from any hacking attack because investigations found that many hackers were planning to target the crypto investors.

Don't download files!

Compromised friends may send a weaponized Excel file with the name "exchange fee comparision.xls". It contains malicious code, encoded backdoor and etc.

Hackers target the cryptocurrency industry – Microsoft Security Blog https://t.co/62F1Yh4u5u

— CZ Binance (@cz_binance) December 7, 2022

Microsoft noted that hackers usually send the .xls format table with the title “exchange fees comparison”. That file usually contains malicious code, which can’t be identified by crypto investors easily.

Read also: Binance CEO Says some media gets paid to spread FUDs