Last week, users of the cryptocurrency wallet MetaMask lost money to a phishing scam that lured potential victims through some Google ads.
MetaMask has a community of over a million users. The site offers an Ethereum in the browser via a browser extension that allows distributed applications to read from the blockchain.
When installing the legitimate extension, you can either import an existing wallet or create a new one along with the secret phrase that allows you to access the wallet.
While it's unclear how many MetaMask users were affected by the scam, some say they ended up with empty wallets after clicking on a fraudulent search ad that was "promoted" as a MetaMask site.
The phishing/advertising scam is still active, with a new domain constantly being promoted through Google search ads
On Wednesday, MetaMask alerted its community to the scam and suggested using direct links to the legitimate URL and staying away from sponsored ads.
The warning came too late for some users, as some users reported losses of tens of thousands of dollars.
The complaints started to increase this week, and all the stories described the same scenario: money was lost after trying to install the MetaMask browser extension.
It was determined that users were being directed to a MetaMask phishing page via Google ads. When they reached the page, they were asked to install the extension, which gave them the option to either import an existing wallet or create a new one.
If they clicked the “Create Wallet” button, they were taken to the real MetaMask.io website, as there was no cryptocurrency to steal. However, if they clicked “Import a wallet,” they had to enter the passphrase of their existing wallet, which was then sent to the attacker.
Once the attackers received the passphrase, they proceeded to empty victims. In responses to MetaMask's warning on Twitter, one user said he was robbed of nearly $30,000.
Source: bleepingcomputer.com
