4 ms·
Phishing scammers impersonate AH employee to drain crypto wallets
- davidmurdoch 2y agoTitle should be "Phishing scammers impersonate Andreessen Horowitz employee to drain crypto wallets"
- throwaway290 2y agoOr "A16z" at least...
- michaelteter 2y agoI had to quickly check that my Albert Heijn bonus account hadn't been robbed!
- Arnt 2y agoI tried that. Too long. Not essential anyway, IMO, the attack is much more interesting than the victim's employer's name.
- Centrino 2y agoThe only reason I clicked the link was to know what AH meant. Phishing for crypto assets is nothing new, I wouldn’t have clicked it for that.
- Arnt 2y agoIf I understand the attack correctly: Twitter followers were migrated, but anyone "following" using something like a crontab that retrieves a link based on the old Twitter name might be fooled. Even that is apparently not to fringe to work for phishing.
- xsmasher 2y agoThey could also make initial contact with victims using the scam account (new account that took the old user name).
- deleted 2y ago[deleted]
- Lalabadie 2y agoThe title sounded like a crypto thing, so I assumed it was some web3 term like Auction House
- 0x111 2y agoThere are ways in which people claiming to be from a16z could authenticate themselves in DMs, using services like b2v.xyz
- rib3ye 2y agoWhat's scary is if you google Vortax, it comes up like a totally legit videochat app.
- skilled 2y agoWas able to find one article calling it out, https://davidgerard.co.uk/blockchain/2024/04/03/vortax-a-fake-scam-ai-company-just-like-the-old-ico-days/ https://davidgerard.co.uk/blockchain/2024/04/03/vortax-a-fak... Genius approach on their part tho. The landing page looks legit, the site even has blog posts.
- michaelteter 2y agonowadays this is so much easier to generate.
- squigz 2y agoThe barrier to entry of making legit-looking scams has never been very high, to the point where I don't believe them being even easier to generate makes any difference
- rendall 2y agoMy god. Even a marketing article comparing it to Google Meet. https://medium.com/@VorionApp/vortax-vs-google-meet-what-are-the-key-differences-d0ac3fc3f385 https://medium.com/@VorionApp/vortax-vs-google-meet-what-are...
- elphinstone 2y agoYes, it reads fairly legit too, not LLM copypasta. Wonder if the scammer was literate or they hired an actual copywriter? Probably just reworded a legit writeup of another product, though. But looking for all the "Vortax" bs they put ou there could be a trail to find them.
- rendall 2y ago
- dboreham 2y agoAH == a16z it seems.
- CoastalCoder 2y agoAnd not "Attack Helicopter", which is the only acronym of which I could initially think.
- michaelteter 2y agoAnd here I was wondering why a Dutch grocery store employee had access to any significant amount of crypto...
- jowea 2y agoThe real question to me was who would be fooled by an official pretending to be from a country that ceased existing a century ago.
- thih9 2y agoThis works because we've been conditioned to install videochat plugins, no matter the security warnings. Personally I installed a few of these. I remember when running Google Meet without Chrome required some plugin and when Zoom required admin password every now and then to perform an update (even after the Mac vulnerability incident[1]). I hope I'll think twice next time I see a prompt to install a plugin like this. [1]: https://techcrunch.com/2019/07/10/apple-silent-update-zoom-app/ https://techcrunch.com/2019/07/10/apple-silent-update-zoom-a...
- Angostura 2y agoIt worked partly because the company website listed the scammer’s Twitter handle as legit
- codedokode 2y agoAnd because OS allows a video chat app to access wallet's private key.
- thih9 2y agoAn OS will never protect every wallet; the user can move to an OS and wallet combination that provides sufficient protection for them.
- lostmsu 2y agoAh good, looks like avoiding the Zoom, Telegram, etc apps and using website instead, and only installing messengers that are sandboxed is paying off.
- codedokode 2y agoWhy installing an app allows to "drain wallets"? Why does a video chat app, which is installed from untrusted source, have an access to a wallet private key? Why OS allows this?
- matsz 2y agoThere is no way to prevent this on the OS level without making an OS as locked down as iOS. Anything less, and the user will find a way to accidentally give admin permissions to random apps. NB: I don't believe that it's the OS's job to protect the user from themselves. Shielding people from consequences of their own actions results in people making worse mistakes later on.
- codedokode 2y agoThe OS's job is to protect user from malicious apps or apps with vulnerabilities. It does its job very poorly, for example, I have to manually build sandboxes and create users for every app, and I don't understand why this cannot be built-in and automated.
- namaria 2y agoHonestly, trusting the OS to save you is a bad idea. Why people have one omni device that owns their identity and assets and they will install software "someone online" asked them to on it is beyond me. Horrible opsec all around.
- codedokode 2y agoIt should be safe to install software. Just as opening a page in a browser is safe.
- namaria 2y agoIt will never be safe to run arbitrary code on a general computer. The kind of safety you're talking about is only possible in strictly walled gardens.
- hinkley 2y agoRepudiation is one of the most important features of existing commerce systems and until there's a crypto system that considers that a requirement instead of a cute little non sequitur then nobody serious will ever take crypto currency seriously. It's just a bunch of pyromaniacs repeatedly burning themselves an each other and saying, "huh, that's weird."
- michaelteter 2y agoTwitter (I refuse to use the artist formerly known as bs), considering its great leader, should have detected this before it even went out. Instead, a user who hasn't been active on Twitter for some time can do something totally benign, not even including messaging or posting, and get flagged as suspicious. Meanwhile, an account handle changes, and the old one is reclaimed by someone else. And then very suspicious messages get sent. This should be reasonably detectable with less false negatives than what they subject the rest of us to already.
- spacecadet 2y agoProbably run by AH on the side.