Twitter users having a hard time with their bitcoin wallets should be wary of accounts that offer to fix them. Attackers are using this social engineering method to trick cryptocurrency owners into forking over their wallet recovery codes.

Malwarebytes spotted multiple Twitter accounts seeking to take advantage of people searching for a bitcoin wallet recovery tool. The security firm described those efforts as ‘low maintenance’. That means all attackers needed to do was to set up a profile. Then, they could tweet out a link to a phishing landing page and wait.

Read on to learn what to watch out for when it comes to this type of social engineering.

Breaking the First Rule of Crypto

In its analysis of the campaign, Malwarebytes found that digital attackers targeted Trust Wallet, an app that enables users to send, receive and store bitcoin, as well as other cryptocurrencies.

The attackers targeted real customer support threads on Twitter to trick users into clicking on a link. As part of the social engineering, another attack profile claimed the fake customer support team solved their problem.

But that link didn’t direct anyone to customer support. Instead, it sent them to a phishing landing page that asked them to describe their issue. It then asked users to submit their recovery phrase for their account.

That’s a bad idea.

In late April 2021, the official Twitter account for this application warned users to always remember the “first rule of crypto”, that is, to never give out their recovery phrase. This is exactly the kind of rule social engineering attacks attempt to get around. This recovery code, which can consist of up to 12 words, is how users regain their accounts and their stored cryptocurrency if they lose access. In the wrong hands, the recovery phrase could enable attackers to drain their victims’ accounts.

Other profiles involved in this campaign auto-responded to tweets seeking help from the official account. In their responses, those profiles spammed out links to fake forms hosted on Google Docs. Of course, these also sought to steal users’ recovery phrases.

Other Twitter Social Engineering Scams

Twitter phishing in general and customer support DM slide scams, in particular, have been used numerous times in the past few years.

Digital attackers used the same social engineering technique in April 2014. In that specific attack, they posed as customer support representatives for EA Sports on Twitter. They lead users to a fake website designed to steal access to EA Sports games. Attackers used the same social phishing tactics in 2016 to go after Natwest customers’ bank logins.

How to Defend Against Twitter Social Engineering

Organizations can defend their employees against the types of Twitter social engineering discussed above by investing in their security awareness training programs. They can specifically use phishing simulations that emphasize how unlikely it is that official companies will ever use a form hosted on Google Docs to process official customer support requests. In addition, regularly remind users not to give out their passwords or other secrets to anyone.

More from News

Hackers are Increasingly Targeting Auto Dealers

Auto dealerships are increasingly concerned with cybersecurity in the face of new regulations and an alarming rise in cyberattacks. The Second Annual Global State of Cybersecurity Report by CDK Global found that 85% of dealerships say cybersecurity is very or extremely important relative to other operational areas. Additionally, 89% say cybersecurity is more important than last year, a 12% increase. Not surprisingly, only 37% of auto retailers are confident in the current protection, which is a 21% decrease from 2021.…

LastPass Breaches Cast Doubt on Password Manager Safety

In 2022, LastPass suffered a string of security breaches which sparked concern among cyber professionals and those impacted by the intrusions. Some called into question the way LastPass handled and responded to the incident. In addition, the situation ignited a wider conversation about the risks linked to utilizing password managers. A password manager helps users generate strong passwords and safeguards them within a digital locker. A master password secures all data, which enables users to conveniently access all their passwords…

Good Guys Decrypt Ransomware Targeting Charitable Groups

Imagine you’re an IT manager amid a ransomware attack. While your team scrambles for solutions, the intruders demand a ransom. Of course, you don’t want to pay; you just want your files back. But as time ticks by and the extortionists turn up the heat, your bosses are about to give in and pay the ransom. But then, the FBI calls. “Don’t pay,” the agent says. “We’ve found someone who can crack the encryption.” Sound too good to be true?…

Threat Groups Offer $240k Salary to Tech Jobseekers

Dark web forums are home to various individuals interested in conducting illicit or questionable activities. These forums offer opportunities such as the transaction of stolen data, Malware-as-a-Service, hacking services and invitations to collaborate in hacktivism. Cyber crime team members are recruited directly from the source: the dark web. What does this activity look like? Kaspersky recently conducted an analysis of 155 dark web forums from January 2020 to June 2022. They examined job postings and resumes that contained information about…