Web3 Users Beware: Phishing Scams from Imitation Accounts on Social Media Platforms

Recently, with the increase in various airdrop activities, Web3 users have welcomed a harvest season. However, this has also attracted the covetousness of criminals. Some criminal gangs are using social media platforms, especially on a certain well-known Weibo platform, to implement phishing scams by creating highly similar official accounts, posing a serious threat to users' fund security.

It is understood that these criminals will post a large number of fake airdrop claim links in the comments section of official project accounts, enticing users to click and attempt to claim tokens. Once users let their guard down, they are likely to suffer financial losses. This "high imitation account phishing scam" has developed into an organized and large-scale criminal activity characterized by highly industrialized and scaled operations.

In recent months, multiple victims have reported that they encountered theft after clicking on so-called "airdrop claim links" on a certain Weibo platform. These links are actually phishing links posted by high-fake accounts of projects like Etherfi, Tabi, Zeta, and Savm.

Taking the case of a victim of a high-fake Etherfi account as an example: On March 15, ether.fi announced that its tokens would be listed on several well-known trading platforms. However, it wasn't until March 18 that the project team released the official airdrop query link. Criminals took advantage of this 3-day time gap to spread false $ETHFI claiming links on social media platforms, causing the victim to mistakenly believe it was a real link. After clicking, they were tricked into authorizing, resulting in a loss of 136.2 ETH. Currently, the phishing webpage is no longer accessible, and the high-fake account has also disappeared.

After tracing the victim addresses of multiple cases of this type by technicians, it was found that the addresses of multiple authorized phishing attackers (spender) were all 0x0000db5c8B030ae20308ac975898E09741e70000, which has been marked as Inferno Drainer.

In fact, the high-fake account scam has formed a complete black industrial chain, including purchasing social media accounts related to cryptocurrency, targeted content promotion, large-scale dissemination, generating phishing websites, and other links. These operations not only have a clear operational process but can also accept cryptocurrency payment-related services in an anonymous manner.

Fraudsters first purchase high-quality social media accounts with a large number of followers and account verification, then copy the official account's profile picture and description, using a very similar ID to create highly deceptive counterfeit accounts.

On a certain instant messaging platform, there are numerous groups for buying and selling social media accounts. These sellers require payment in cryptocurrency and the provided trading accounts are often related to the cryptocurrency industry, with a certain level of daily activity and fan base.

By analyzing the payment address provided by a seller, it was found that this address had multiple transactions with high-risk addresses marked as "money laundering, online gambling." This seemingly harmless social media account trading behavior actually provides convenience for criminals to carry out fraudulent activities.

Fraud gangs also utilize the content recommendation mechanisms of social platforms to effectively push fraudulent information to target audiences. Common tactics include inflating numbers in the comments section and using fake accounts to pollute keyword searches. They post fake airdrop claim links under tweets from official accounts and deceive victims into trusting them by mimicking tones and using bots to inflate likes, shares, replies, and other interactions.

Another common tactic is to use fake accounts for keyword pollution. Scammers create content using enticing phrases like "check eligibility, claim airdrop, free minting of NFTs" and publish information with fraudulent links related to specific blockchain protocols. When potential victims search for relevant keywords, they may encounter information from these fraudulent accounts, posing a threat to ordinary investors.

In addition to utilizing the platform's recommendation mechanism, some social media platforms and search engines have failed to effectively filter fraudulent information during paid promotion, inadvertently providing a promotion channel for phishing links. For example, after the announcement of a well-known options project $PRCL's upcoming airdrop, a large number of counterfeit accounts began posting phishing links and purchased promotion services for widespread dissemination.

In terms of technical support, most of the stolen funds ultimately flow to addresses marked as Inferno Drainer. Inferno Drainer is a type of malware specifically designed to illegally empty cryptocurrency wallets, and its developers rent it out for others to use. Once the victim scans the QR code on the phishing website and connects their wallet, Inferno Drainer will detect and lock in the most valuable and easily transferable assets in the wallet, initiating malicious transactions. 20% of the stolen assets belong to the software developers, while 80% belong to the scammers.

To prevent this type of fraud, Web3 users should:

1. Understand the basic mechanisms of social media, remember the unique ID of official accounts, and use the number of mutual followers as an important criterion to identify real and fake accounts.

2. Verify the authenticity of the link through multiple channels, including the official forum of the project party, communication groups, and third-party media, etc.

3. Carefully identify the content of the wallet plugin pop-up and do not easily sign transactions with uncertain details.

4. Be cautious with links in long comment sections, as this is often where phishing links are most rampant.

With the increasing industrialization of cryptocurrency-related cybercrime, not only are user interests harmed, but the healthy development of the entire industry is also affected. Users need to remain vigilant while engaging in online activities and should seek professional help promptly when encountering suspicious situations.