Cyberattackers are targeting users of the OpenSea nonfungible token (NFT) platform with a phishing attack that lures users with the potential sale of items listed on the marketplace. The aim? Draining their cryptocurrency wallets dry.
Researchers at Cofense discovered the campaign, in which adversaries impersonate the OpenSea website and claim a user has a new offer on a listing on the site to try to bait them into clicking on a malicious link.
“The goal of the phishing scheme is to get recipients to connect their crypto wallets to the phishing page, which will drain their wallets,” Cole Adkins of the Cofense Phishing Defense Center wrote in a post. “The phish presents itself as an offer on an NFT the recipient has listed on OpenSea, in hopes they will click on it and connect their wallet once redirected.”
OpenSea is the largest marketplace for NFTs and thus “the go-to platform for many entry-level NFT enthusiasts looking to enter the crypto collectible market,” who are likely unaware of the common tactics of phishers and thus can easily be fooled, he wrote.
The campaign demonstrates the speed with which attackers are targeting new and emerging technologies like NFT — which held little interest for people until OpenSea was launched in 2017 — with custom campaigns tailored to their particular interests, he said. OpenSea marketplace currently has more than 2 million users with at least one transaction on the site, many of them enterprise users.
