The cryptocurrency rewards platform Celsius Network faced a security breach that revealed customer information which led to a phishing attack.
Today, the CEO of Celsius Alex Mashinsky said that the third‑party marketing server of Celsius had been breached and that threat actors gained access to a list of Celsius customers.
See also: MacKenzie Scott Foundation: Phishing campaign reaches thousands of inboxes
After gaining access to the customer list, the threat actors impersonated Celsius Networks in phishing texts and emails that promoted a new Celsius Web Wallet. As an incentive to get people to visit the site, the text stated that Celsius offers $500 in CEL cryptocurrency if they create a wallet and enter a special offer code.
The users, after clicking, were directed to the phishing site celsiuswallet[.]network, which is now offline, where visitors were asked to create a Celsius Web Wallet.
See also: Phishing attacks use fake COVID-19 vaccine research to steal personal information
In the stage of creating the fake profile, the website asked visitors to link their other online wallets and to enter the recovery phrases of those wallets. Once this generic phrase was given, malicious actors can import your wallet and steal any cryptocurrency that was inside it.
VirusTotal shows that the phishing domain celsiuswallet[.]network initially had a DNS SOA record indicating that it was registered with Njalla.
See also: Brazil: First in phishing attacks. Which countries follow?
Njalla is a registrar based in Sweden and is a favorite of some very well-known hacking groups like Fancy Bear and Cozy Bear.
Information source: bleepingcomputer.com
