A hacker collective known as Pink Drainer has been employing phishing attacks to steal cryptocurrency and non-fungible tokens (NFTs) from Discord and Twitter users. The group impersonates journalists from leading crypto media outlets, such as Cointelegraph and Decrypt, to gain the trust of their victims.
Once they have established trust, the hackers request that their victims undergo a KYC (know your customer) validation to confirm their identities. The victims are then guided to fraudulent websites designed to steal their Discord authentication tokens.
Victims are duped into interacting with malicious bots, such as a fake Carl verification bot. They are instructed to bookmark a page containing harmful JavaScript code by clicking a “Drag Me” button on the site. This action results in the theft of the victims’ Discord tokens, giving the hackers access to the accounts without needing to know the account credentials or bypass two-factor authentication (2FA).
Once inside the account, Pink Drainer elevates its control by setting itself as the administrator and removing all other admins. This move allows the threat actors to plunder digital assets and sensitive information without disturbance.
In scenarios where the compromised account belongs to a high-profile person or project with a large following, Pink Drainer exploits this access to advertise fake giveaways, fraudulent mints, cryptocurrency scams, and phishing pages.
Read also: The NFT Community Hacked Again on Twitter
According to ScamSniffer, a cybersecurity analytics firm, Pink Drainer has successfully breached the accounts of approximately 1,932 victims, amassing stolen digital assets worth close to $3 million on the Mainnet and Arbitrum, a layer 2 scaling solution for Ethereum. ScamSniffer’s on-chain monitoring bots detected the threat actors in action when they pilfered $327,000 worth of NFTs from a single investor.
Several high-profile figures and organizations within the crypto space have reportedly been targeted by Pink Drainer. These include Mira Murati, the CTO of OpenAI, renowned musician Steve Aoki, and numerous prominent crypto entities like Evmos, Pika Protocol, Orbiter Finance, LiFi, Flare Network, Cherry Network, and Starknet.
Despite concerted efforts to combat their activities, Pink Drainer remains at large. This underscores the need for individuals and entities with considerable digital assets to exercise heightened caution, particularly regarding communications from media outlets. Here are some tips for protecting yourself from Pink Drainer and other phishing attacks:
- Be wary of any unsolicited communications, especially from people or organizations you don’t know.
- Never click on links in emails or messages from people you don’t know.
- If you must click on a link, hover over it with your mouse to see where it will take you before clicking.
- Be careful about what information you share online, especially your personal information and financial information.
- Use strong passwords and two-factor authentication (2FA) for all of your online accounts.
- Keep your software up to date, including your operating system, web browser, and security software.
By following these tips, you can help to protect yourself from Pink Drainer and other phishing attacks.
You might like this: Yuga Labs Discord Server Hacked; NFT Worth Over 200 Eth (361,000 $) Stolen
This information is published by the NFT News media team.
