A sneaky cyberattack aimed at defrauding Coinbase employees via fake SMS notifications has recently emerged.
In a recent breach, an anonymous threat actor managed to gain access to Coinbase’s systems by stealing the login credentials of an employee. The incident highlights the importance of companies and individuals taking extra security measures when dealing with cryptocurrency exchanges.
After the breach, the attacker gained access to contact information for several Coinbase employees, however, customer funds and data were not affected.
Coinbase shared its research findings to help other companies identify the threat actor's tactics, techniques, and process (TTPs) and create appropriate defenses.
See also: Cyberattack on FBI computer network
See also: GoDaddy: Hackers stole source code and installed malware on servers
Details of the attack
The attacker targeted several Coinbase engineers on Sunday, February 5th with SMS notifications urging them to log into corporate accounts to read an important message.
Although the majority of employees ignored the messages, one person was unfortunately tricked into following a link to a phishing page. After entering their login details, they were prompted with an unexpected thank you before being told to ignore what had happened.
In the next phase, the attacker attempted to log in to Coinbase's internal systems using the stolen credentials but failed because access was protected by multi-factor authentication (MFA).
About twenty minutes later, the attacker changed his approach. He called the employee pretending to be a Coinbase IT specialist and told him to log into his computer and comply with specific instructions.
See also: Earth Kitsune: Uses new WhiskerSpy malware in its attacks
Coinbase’s Computer Security Incident Response Team (CSIRT) detected suspicious activity on its system just 10 minutes after the attack began and immediately contacted the victim. At that point, the employee realized something was wrong and cut off communication with the attacker.
For those who don't know: Coinbase is a digital currency exchange platform founded in 2012. It allows users to buy and sell cryptocurrencies with fiat currencies (i.e. regular government- issued money ) , as well as store them securely on its platform . It currently supports over 50 different types of cryptocurrencies, with more being added regularly.
Information source: bleepingcomputer.com
