Group-IB, a global leader in preventing and investigating high-tech crimes, and high-grade threat intelligence and anti-fraud solutions provider, has detected a scam attack on Numerai, a hedge fund that was the first to launch its own cryptocurrency, the Numeraire (NMR) earlier this year. Fraudsters offered to estimate how much NMR a user is entitled to, if ETH Wallet Address and Balance is provided.
Spreading this offer via Slack using the name of a Numerai employee, fraudsters proposed recipients an opportunity to claim an NMR airdrop. Having provided ETH Wallet Address and Balance, and receiving an NMR balance estimate, the victim is then asked for a private key (which no site should ask for) supposedly for a verification procedure. Once fraudsters receive the key they promptly drain the account.
The phishing page is quite well made – aside from the video embedded and the absence of favicon, which would potentially alert an aware user – all links work by redirecting the user to 3rd party web-sites and even to the company’s original page.
Senior Analyst CERT-GIB
Phishing site suggests entry of a private key for ETH wallet verification
Following simple cybersecurity best practices can considerably minimize risks:
- Be cautious of any proposals you receive online, especially coming from unknown accounts.
- Even if you receive a message with a proposal from a known contact, think twice before clicking.
Their account may be compromised. - When it comes to sensitive topics, i.e. personal data, money transfers, etc. check the URL of the resource. If you aren’t sure, google it. Wikipedia articles and official social media channels can help.
- No one web-site, call center operator, or messenger should ask you for sensitive data like passwords, PIN‑codes, or any private keys.
