English
Blockchain Security Firm SlowMist Notifies Decentralised Social Network Friend.tech of Phishing Attacks
Phishing attacks target users of friend.tech by disseminating a malevolent link that harbours a JavaScript script, with the intention of illicitly acquiring their account credentials and funds. By impersonating interviewers and monitoring the target's Twitter network, the attack is executed. SlowMist cautions users about these types of attacks and offers advice on how to circumvent them.
SlowMist, a blockchain security firm, has reportedly issued a warning to users of the decentralised social network friend.tech regarding an increase in fraud attacks. On October 14, Twitter user Masiwei was the first to report the issue; he detected a malicious code that was designed to steal friend.tech accounts. An investigation by the SlowMist Security Team unveiled that the assailants distributed a hyperlink comprising a malevolent JavaScript script.
The malevolent script targeted friend.tech users in particular, with a particular emphasis on Key Opinion Leaders (KOLs) whose notoriety suggested they were more likely to be extended interview invitations. By following individuals of the target's Twitter network, the assailant created the illusion of a sense of community on the Twitter page of the target. Subsequently, the assailant would arrange interviews, direct users to subscribe to the interview Telegram, and furnish a synopsis. Subtly posing as verification, the assailant requested users to complete a form and click on a phishing link following the interview. Users unintentionally disclosed their friend.tech account credentials, which comprised the password (2FA) and tokens linked to the embedded wallet Privy, by accessing the bookmark that contained the malicious JavaScript script. As a result, the user's friend.tech account and any associated funds were rendered susceptible to theft.
SlowMist advises increasing awareness of social engineering attacks, refraining from clicking on unfamiliar links, and developing the ability to identify phishing links by verifying their correspondence with official domains and examining domain names for misspellings or excessive punctuation. Additionally, the company recommends that users install anti-phishing plugins. Users of friend.tech have experienced the theft of their digital assets previously. ZachXBT, an on-chain investigator, disclosed last month that SIM card manipulation targeted users of friend.tech. The 2FA password feature was implemented by the friend.tech team as a proactive measure to bolster user security and mitigate the risk of SIM-swap attacks.
Bonus rebate to help investors grow in the trading world!
