Bitcoin Phishing Scam Attack Exposes Thousands of People's Personal Data

People getting conned into revealing valuable information is by no means a new phenomenon on the Internet. In fact, phishing scams have become one of the most prominent and effective methods of attack, claiming new victims all the time. While there has been a great push to combat this particular threat, the sad fact is that phishing attacks have only grown in frequency, effectiveness, and sophistication as time has moved forward. Case in point, the fraud discovered and reported by Group-IB.

According to Group-IB, a Singapore-based intelligence company, the targeted multistage Bitcoin (BTC) scam propagated by a number of fraudulent websites they uncovered recently has claimed the data for thousands of people.

Potential targets' phone numbers, as well as names and emails, were used in personalized URLs, which were employed to redirect people to the phishing websites. Said phishing pages were set up to appear to belong to local news outlets, and were really convincing – right down to the fake comment sections, containing fake posts by famous local personalities. As per the report of Group-IB:

"Further analysis of the URLs revealed that a short link takes a victim to another URL which already demonstrates their personal data, such as the phone number, first or/and last name, and sometimes an email address, and used for redirects to fake websites masquerading as a local media outlet. [...] The experts believe that the personal information info could have been obtained by fraudsters through a separate fraudulent scheme or simply bought from a third party."

In other words, the hackers did a lot of due diligence and used information that they found elsewhere to craft a convincing enough scam to trick a bunch of people. And the users bought into the fraud - Group-IB's research indicates that nearly 150 000 people fell victim to this scam in the UK alone, and a bunch more spread all across the rest of the world took the bait as well.
Overall, this isn't really a surprising turn of events, as this is one of the more sophisticated phishing campaigns recently.

"Fraudulent schemes have become more complicated. They now involve several stages, complex distributed infrastructure, and abuse of personal and corporate brands that is hard to track down and block using traditional detection methods. Companies and celebrities whose names were hijacked by fraudsters suffer reputational damage and face diminished customer trust."

So What Can You Do to Avoid Being Phished?

Here are some simple tips to help you avoid the depredations of scammers that may try to steal your private information and use it for nefarious purposes.

1. Always be on the look out for suspicious details that may be a sign that an email in your inbox is fraudulent. Always look at said email's sender – if it's suspicious, that's usually a dead giveaway that something's wrong.
2. Don't trust a source just because it has your credentials. Said credentials could have been leaked from another platform that has suffered a data breach and thus may have been used by a hacker in a personalized attack against you.
3. Don't trust a source just because of the name it is brandishing. Fraudsters have the habit of abusing popular brands to try and add an air of legitimacy to their schemes. Always make sure to check the origin of your communications, as well as the URL of the page you're currently on, and if you find anything suspicious – avoid it like the plague.
4. Don't follow links in unsolicited emails, no matter how convincing they may appear at first. Take the time to investigate them critically.
5. Never automatically trust any page that asks you to input your credentials. Always diligently check its URL and make sure that it's not a bogus landing page, designed to trick you into revealing personal information.
6. Consider investing in a password manager. Not only will it save you the trouble of coming up with, remembering and inputting complex passwords, but it will automatically fill in legitimate forms for you, and give you a heads up about any shenanigans that hackers may have in store for you when it comes to landing pages, fake websites, etc.