tl;dr
A pseudonymous investigator has revealed a scheme using hacked accounts on social media platform X to promote a fake memecoin. The cybercriminal stole credentials of high-profile X accounts through phishing emails impersonating the X team. The attacker compromised 15 accounts and stole approximatel...
A pseudonymous investigator has revealed a scheme using hacked accounts on social media platform X to promote a fake memecoin. The cybercriminal stole credentials of high-profile X accounts through phishing emails impersonating the X team. The attacker compromised 15 accounts and stole approximately $500K over a month. The bad actor bridged between Solana and Ethereum to obfuscate the funding source. The attacker sent fake copyright infringement emails to prompt users to reset their password and 2FA, leading to a phishing site. Once compromised, the attacker controls posting access to share malicious links promoting a scam token.
Security measures recommended include limiting email address reuse between services and using security keys for 2FA on important accounts.
A pseudonymous on-chain investigator says he’s unraveling a malicious scheme that’s using hacked accounts on the social media platform X to promote a fake memecoin. ZachXBT says the cybercriminal stole the credentials of high-profile X accounts by sending phishing emails that impersonated the X team. The emails appear as a notice of policy and guideline violations from X to create a sense of urgency and get the recipients to click a malicious link.
“A threat actor has stolen ~$500K over the past month by compromising 15 X accounts (Kick, Cursor, Alex Blania, The Arena, Brett, etc). Each of the 15 ATOs were directly connected by mapping out the deployer address for each scam. The attacker bridged back and forth between Solana and Ethereum in an attempt to obfuscate the funding source.”
Image Source: ZachXBT/X
According to smart contract platform Neutron, the bad actor sent fake copyright infringement emails that told the targeted X users to reset their password and two-factor authentication (2FA) by visiting what turned out to be a phishing site. Once the X account is compromised, the attacker logs out all sessions, changes security settings and then controls posting access to share malicious links that promote a scam token.
Says ZachXBT about security measures, “Make sure to limit email address reuse between services as well as using security keys for 2FA on important accounts whenever possible.”