Netskope named a Leader in the 2022 Gartner® Magic Quadrant™ for Security Service Edge. Get the Report.

  • Products

    Netskope products are built on the Netskope Security Cloud.

  • Platform

    Unrivaled visibility and real-time data and threat protection on the world's largest security private cloud.

Netskope Named a Leader in the 2022 Gartner Magic Quadrant™ for SSE Report

Get the report Go to Products Overview
Netskope gartner mq 2022 sse leader

Netskope delivers a modern cloud security stack, with unified capabilities for data and threat protection, plus secure private access.

Explore our platform
Birds eye view metropolitan city

Make the move to market-leading cloud security services with minimal latency and high reliability.

Learn more
Lighted highway through mountainside switchbacks

Prevent threats that often evade other security solutions using a single-pass SSE framework.

Learn more
Lighting storm over metropolitan area

Zero trust solutions for SSE and SASE deployments

Learn more
Boat driving through open sea

Netskope enables a safe, cloud-smart, and fast journey to adopt cloud services, apps, and public cloud infrastructure.

Learn more
Wind turbines along cliffside
  • Our Customers

    Netskope serves more than 2,000 customers worldwide including more than 25 of the Fortune 100

  • Customer Solutions

    We are here for you and with you every step of the way, ensuring your success with Netskope.

  • Training and Certification

    Netskope training will help you become a cloud security expert.

We help our customers to be Ready for Anything

See our Customers
Woman smiling with glasses looking out window

Netskope’s talented and experienced Professional Services team provides a prescriptive approach to your successful implementation.

Learn more
Netskope Professional Services

Secure your digital transformation journey and make the most of your cloud, web, and private applications with Netskope training.

Learn more
Group of young professionals working
  • Resources

    Learn more about how Netskope can help you secure your journey to the cloud.

  • Blog

    Learn how Netskope enables security and networking transformation through security service edge (SSE).

  • Events & Workshops

    Stay ahead of the latest security trends and connect with your peers.

  • Security Defined

    Everything you need to know in our cybersecurity encyclopedia.

Security Visionaries Podcast

Episode 15: Building Permanent Security Awareness

Play the podcast
Black man sitting in conference meeting

Read the latest on how Netskope can enable the Zero Trust and SASE journey through security service edge (SSE) capabilities.

Read the blog
Sunrise and cloudy sky

SASE Week

Netskope is positioned to help you begin your journey and discover where Security, Networking, and Zero Trust fit in the SASE world.

Learn more
SASE Week

What is Security Service Edge?

Explore the security side of SASE, the future of network and protection in the cloud.

Learn more
Four-way roundabout
  • Company

    We help you stay ahead of cloud, data, and network security challenges.

  • Why Netskope

    Cloud transformation and work from anywhere have changed how security needs to work.

  • Leadership

    Our leadership team is fiercely committed to doing everything it takes to make our customers successful.

  • Partners

    We partner with security leaders to help you secure your journey to the cloud.

Netskope enables the future of work.

Find out more
Curvy road through wooded area

Netskope is redefining cloud, data, and network security to help organizations apply Zero Trust principles to protect data.

Learn more
Switchback road atop a cliffside

Thinkers, builders, dreamers, innovators. Together, we deliver cutting-edge cloud security solutions to help our customers protect their data and people.

Meet our team
Group of hikers scaling a snowy mountain

Netskope’s partner-centric go-to-market strategy enables our partners to maximize their growth and profitability while transforming enterprise security.

Learn more
Group of diverse young professionals smiling

New Phishing Technique Targeting Over 20 Crypto Wallets

Nov 10 2022

Summary

Netskope Threat Labs spotted a new crypto-phishing attack that aims to steal sensitive data from crypto wallets, including private keys and security recovery phrases, disguising itself as a service to revoke stolen ERC (Ethereum Request for Comments) assets. The page was created and hosted with Netlify, which is a free cloud service to create websites and apps.

What makes this a novel technique is that the attacker is targeting 21 cryptocurrency wallets in the same page, eliminating the need to maintain individual websites for each type of crypto wallet, like we saw in the crypto-phishing campaigns we spotted in August and September. Those attacks were targeting multiple crypto wallets through a chained phishing attack abusing Google Sites and Microsoft Azure.

In this blog post, we will analyze this phishing page to demonstrate how this new technique works.

How it Works

The phishing page is hosted with Netlify and the main page tries to lure the victim by mimicking a service to revoke stolen ERC assets. To lure the user to use the fake service the page offers a fake connection with 21 different cryptocurrency wallets, which include:

  • MetaMask
  • Trust
  • Coinbase
  • crypto.com
  • Blockchain
  • Binance Smart Chain
  • Safepal
  • Argent
  • Fortmatic
  • Aktionariat
  • Keyring Pro
  • BitKeep
  • SparkPoint
  • OwnBit
  • Infinity Wallet
  • Wallet.io
  • Infinito
  • Torus
  • Nash
  • BitPay
  • imToken
Screenshot of the main phishing webpage, hosted on Netlify.
Phishing’s main webpage, hosted on Netlify.

Once the victim selects a cryptocurrency wallet to connect, the phishing page displays a fake modal that simulates a connection with the wallet’s service.

Example ofphishing simulating an initialization process with MetaMask.
Phishing simulating an initialization process with MetaMask.

Then, a new modal is displayed, asking the victim for sensitive data in order to proceed with the fake revoking service. It tries to steal three different types of data. The first one is the cryptocurrency private key

In this specific modal, there’s even a typo in the word “Revoke”.

Screenshot of phishing trying to steal the private key from a crypto wallet.
Phishing trying to steal the private key from a crypto wallet.

The second piece of data it tries to steal is the security recovery phrase, which can be used to import the wallet, as we explained in a previous blog post.

Screenshot of phishing trying to steal the security recovery phrase from a crypto wallet
Phishing trying to steal the security recovery phrase from a crypto wallet.

And lastly, it tries to steal a keystore file in JSON format.

Screenshot of phishing trying to steal the keystore file from a crypto wallet.
Phishing trying to steal the keystore file from a crypto wallet.

Once the “Revoke Signature” button is clicked, the webpage sends the sensitive data to the attacker through a POST request to the same page.

Example of POST request sending the private key to the attacker.
POST request sending the private key to the attacker.

Finally, after stealing the data, the page shows a message that says it was not possible to revoke and asks to try for another wallet. It also automatically closes the modal and opens a new one for a different wallet.

Screenshot of fake message displayed by the phishing page.
Fake message displayed by the phishing page.

These three pieces of sensitive data (privacy key, recovery phrase, and keystore JSON) that the attacker tries to steal can be all used to provide access to someone’s crypto wallet, allowing the attacker to exfiltrate currency.

Aside from these 21 targets, the webpage also contains an option to connect to “Other Wallets”, increasing the attack surface even more, covering possible crypto wallets that are not listed by the attacker.

Conclusions

This technique shows how an attacker can increase the chances of success and also reduce their costs by targeting multiple crypto wallets at the same time with a single page hosted with a cloud application. We strongly recommend individuals to not enter sensitive details, such as private keys and secret recovery phrases, on unknown websites. If you’ve lost access to your account, please contact the official support for your wallet to verify the correct steps to follow.

Protection

Netskope Threat Labs is actively monitoring this campaign and has ensured coverage for all known threat indicators.

IOCs

Phishing URL

hxxps://revolknfts.netlify[.]app/index

author image
Gustavo Palazolo
Gustavo Palazolo is an expert in malware analysis, reverse engineering and security research, working many years in projects related to electronic fraud protection. He is currently working on the Netskope Research Team, discovering and analyzing new malware threats.