Phishing scammers impersonate AH employee to drain crypto wallets | Hacker News Reader

Phishing scammers impersonate AH employee to drain crypto wallets

web3isgoinggreat.com

47 pointsArnt38 comments

Title should be "Phishing scammers impersonate Andreessen Horowitz employee to drain crypto wallets"

Or "A16z" at least...

I had to quickly check that my Albert Heijn bonus account hadn't been robbed!

I tried that. Too long. Not essential anyway, IMO, the attack is much more interesting than the victim's employer's name.

The only reason I clicked the link was to know what AH meant. Phishing for crypto assets is nothing new, I wouldn’t have clicked it for that.

If I understand the attack correctly:

Twitter followers were migrated, but anyone "following" using something like a crontab that retrieves a link based on the old Twitter name might be fooled.

Even that is apparently not to fringe to work for phishing.

They could also make initial contact with victims using the scam account (new account that took the old user name).

The title sounded like a crypto thing, so I assumed it was some web3 term like Auction House

This works because we've been conditioned to install videochat plugins, no matter the security warnings.

Personally I installed a few of these. I remember when running Google Meet without Chrome required some plugin and when Zoom required admin password every now and then to perform an update (even after the Mac vulnerability incident[1]).

I hope I'll think twice next time I see a prompt to install a plugin like this.

[1]: https://techcrunch.com/2019/07/10/apple-silent-update-zoom-a...

It worked partly because the company website listed the scammer’s Twitter handle as legit

And because OS allows a video chat app to access wallet's private key.

An OS will never protect every wallet; the user can move to an OS and wallet combination that provides sufficient protection for them.

Ah good, looks like avoiding the Zoom, Telegram, etc apps and using website instead, and only installing messengers that are sandboxed is paying off.

Why installing an app allows to "drain wallets"? Why does a video chat app, which is installed from untrusted source, have an access to a wallet private key? Why OS allows this?

There is no way to prevent this on the OS level without making an OS as locked down as iOS.

Anything less, and the user will find a way to accidentally give admin permissions to random apps.

NB: I don't believe that it's the OS's job to protect the user from themselves. Shielding people from consequences of their own actions results in people making worse mistakes later on.

The OS's job is to protect user from malicious apps or apps with vulnerabilities. It does its job very poorly, for example, I have to manually build sandboxes and create users for every app, and I don't understand why this cannot be built-in and automated.

Honestly, trusting the OS to save you is a bad idea. Why people have one omni device that owns their identity and assets and they will install software "someone online" asked them to on it is beyond me. Horrible opsec all around.

It should be safe to install software. Just as opening a page in a browser is safe.

It will never be safe to run arbitrary code on a general computer.

The kind of safety you're talking about is only possible in strictly walled gardens.

What's scary is if you google Vortax, it comes up like a totally legit videochat app.

Was able to find one article calling it out,

https://davidgerard.co.uk/blockchain/2024/04/03/vortax-a-fak...

Genius approach on their part tho. The landing page looks legit, the site even has blog posts.

nowadays this is so much easier to generate.

The barrier to entry of making legit-looking scams has never been very high, to the point where I don't believe them being even easier to generate makes any difference

My god. Even a marketing article comparing it to Google Meet. https://medium.com/@VorionApp/vortax-vs-google-meet-what-are...

Yes, it reads fairly legit too, not LLM copypasta. Wonder if the scammer was literate or they hired an actual copywriter? Probably just reworded a legit writeup of another product, though. But looking for all the "Vortax" bs they put ou there could be a trail to find them.

I'm still thinking about this. There must be a enough money in this endeavor for it to be worth expending this kind of energy in making it seem legitimate.

This raises questions.

What other endeavors, corporations, or practices do we accept as legitimate that are clearly not? FTX is one example that's obvious in retrospect. How about suspect practices that have become legitimized because of the sheer money and power accrued? I'm thinking for example banks that have been caught red-handed doing business with mafias or terrorists but have not been punished. But those are knowns. What are the unknowns?

AH == a16z it seems.

And not "Attack Helicopter", which is the only acronym of which I could initially think.

And here I was wondering why a Dutch grocery store employee had access to any significant amount of crypto...

The real question to me was who would be fooled by an official pretending to be from a country that ceased existing a century ago.

Twitter (I refuse to use the artist formerly known as bs), considering its great leader, should have detected this before it even went out.

Instead, a user who hasn't been active on Twitter for some time can do something totally benign, not even including messaging or posting, and get flagged as suspicious.

Meanwhile, an account handle changes, and the old one is reclaimed by someone else. And then very suspicious messages get sent. This should be reasonably detectable with less false negatives than what they subject the rest of us to already.

Probably run by AH on the side.

There are ways in which people claiming to be from a16z could authenticate themselves in DMs, using services like b2v.xyz

.xyz, the TLD that screams legitimacy.

hah true

TLD proliferation has been a disaster - way more scammy, scummy use than legitimate use.

that's true for old TLDs too. Do you have data?

Repudiation is one of the most important features of existing commerce systems and until there's a crypto system that considers that a requirement instead of a cute little non sequitur then nobody serious will ever take crypto currency seriously.

It's just a bunch of pyromaniacs repeatedly burning themselves an each other and saying, "huh, that's weird."

Reply on news.ycombinator.com