In his latest blog, Satnam Narang, a staff research engineer at cybersecurity firm Tenable Inc., has pointed out various non-fungible token (NFT) projects such as Bored Ape Yacht Club (BAYC), Azukis and MoonBirds over the past few months. did. , And OkayBears are disguised on Twitter to steal users’ NFTs and digital currencies such as Ethereum and other altcoins.
Naran is facilitating future integration of many of these projects with the Metaverse to create hype, and there is ample opportunity for scammers to take advantage of new and rumored announcements related to these projects. Explains that it is giving.
“Scammers use Twitter’s mention to get attention,” he said. According to him, recently Twitter users interested in NFTs and cryptocurrencies may have been notified via Twitter mentions. Cryptocurrency scammers tag users with replies that span hundreds of tweets. By mentioning these Twitter usernames, they are intriguing and trying to trick some users into scams.
Naran pointed out some notable scams using Twitter accounts.
In his opinion, airdrops and free NFTs are the best means of cryptocurrency fraud.
One of the best NFTs, BAYC announced ApeCoin airdrops earlier this year to owners of various NFT projects such as BAYC, Mutant Ape Yacht Club and Bored Ape Kennel Club.
Naran saw this as an opportunity for scammers to target their interest in the next airdrop and “started creating campaigns by hijacking verified Twitter accounts and directing users to phishing sites.” Added.
In addition, Narang added that these hijacked validated accounts were pivoted to justify the $ APE token airdrop claim using BAYC NFT profile pictures (PFPs). .. In addition, scammers used these verified accounts to collectively refer to users to get their attention.
Apart from BAYC, scammers are impersonating many other notable NFT projects such as Azukis, Moonbirds and Invisible Friends, as well as new projects on the Solana blockchain like Okay Bears.
Fraudsters have taken every opportunity to plunder NFTs and other digital currencies. One of the things known was when Yuga Labs launched the Otherside Metaverse project on April 30th. This is a way for BAYC NFT holders to purchase a certificate of land in the Metaverse (“Other Certificates”).
The Yuga launch overwhelmed the Ethereum network and brought high gas prices to enthusiasts trying to build land in the Metaverse. Ultimately, this led to significant backlash from some of the project’s loudest supporters.
According to Naran, in response to the backlash from BAYC’s Otherside Metaverse, scammers immediately created a fake Otherside Metaverse on Twitter to take advantage of the frustration felt by these enthusiasts. Refunds of excess gas charges they paid in an attempt to get other acts as well as to create.
Narang has been hitting $ 6.2 million for Mutant Ape Yacht Club (MAYC), BAYC, Azuki, and others due to the recent success of the BAYC Otherside phishing site by researchers using the pseudonym Zachxbt.
Not only that, scammers also warn about scammers who use fake accounts to legitimate tweets. Fraudsters use fake accounts that respond to tweets to make them appear legitimate and further increase investor confidence.
Naran also seeded some of these fake tweets and used Twitter features built into the conversation to limit who could respond to the tweet and let others know about potential future scams. Said to prevent warnings.
Notably, according to the latest data from Spark Toro and Followerwonk, 19.42% is almost four times Twitter’s fourth-quarter 2021 estimate, meeting the conservative definition of fake or spam accounts. I am.
From May 13th to 15th, SparkToro and Followerwonk conducted a rigorous collaborative analysis of five datasets, including various active (ie tweet) and inactive accounts. According to the data statement, “The most compelling analysis uses 44,058 public Twitter accounts that have been active in the last 90 days. These accounts have more than 130 million public actives. Randomly selected by the machine from a set of profiles, 19.42% of which is almost four times Twitter’s Q4 2021 estimate and fits the conservative definition of fake or spam accounts. (That is, it may be underestimated in our analysis).
Twitter’s misleading and deceptive identity policy states, “You can’t impersonate an individual, group, or organization to mislead, confuse, or deceive others, and you can experience others’ experiences on Twitter. You also cannot use fake identities in a way that interferes.
On Twitter, one of the main elements of an ID is the profile of an account with a username (@handle), account name, profile image, and biography.
Twitter policy mentions three ways to identify fraudulent accounts. these are:
1. A profile that portrays the account owner as authentic is unlikely to violate this policy. These types of profiles often use the name of the account owner. Accounts that use trade names, stage names, or pseudonyms may also fall into this category.
2. One of the main factors in their review is to find out if Twitter uses an image that represents another person or entity in their profile. If Twitter finds evidence of misuse of someone else’s image (such as a valid report from a portrayed individual or organization), whether the profile image is being used in a misleading or deceptive manner. Evaluate. It also assesses deceptiveness when an account uses a computer-generated image of a person to pretend to be a non-existent person.
However, Twitter also said, “Using images depicting other people or groups does not necessarily violate this policy, and it is unlikely that the use of images will act on an account that does not mislead others. “.
3. In addition, Twitter will determine if your profile contains another image and will also evaluate the context in which the image is used. However, it’s important to note that Twitter is most likely to take action if you mistakenly claim that your account is the entity depicted in your profile picture, such as a fake or fake account. In rare cases, Twitter may take action against an account that does not use someone else’s image if the profile contains significantly misleading information, such as a location that does not match the account owner’s location.
However, the policy Twitter says, “You are allowed to use pseudonyms. That is, you don’t need to use the account owner’s name or image in your account profile. Accounts that use pseudonyms, or: Please note that “Accounts displayed in” are also described. Others on Twitter do not violate this policy unless their purpose is to fool or manipulate others. “
According to Naran, there are several ways Twitter can intervene in these spoofing to make things difficult for scammers. these are:
1. Not only paying Twitter Blue members, but also making the NFT profile photo feature available to all users.
2. Temporarily hide the tweets and profile of the confirmed account whose profile photo and name will be changed.
3. Create alerts for profiles and links shared by confirmed Twitter accounts that have recently changed their name and profile picture.
4. Watch out for signals such as bulk tagging of tweets. To get the user’s attention, scammers rely on tagging many users in their replies to tweets. If a tweet begins to receive replies that are tagged to multiple users, flag the original tweet / account and subsequent replies as suspicious.
In addition, Naran has led Twitter users to be skeptical of cryptocurrencies. He explains that if a tweet is actively tagged, even from a verified Twitter account, the motive behind it should be very suspicious. Look for cross-reference links that are shared with the original project website and the official website link on Twitter. Scammers also rely on the urgency to try to put pressure on users in this area. If NFT mint is occurring, the number of remaining spots is said to be limited. This urgency makes it easier for users who don’t want to miss an opportunity.
..
