- Malware could self-install and gain control over the user’s device and personal information
- Hacker stole NFTs worth almost $2 million from The Sandbox at the end of 2022
Play-to-earn game The Sandbox announced that some of its users had received a phishing email after a security breach. An employee’s computer was used by an unauthorized third party to send the emails, The Sandbox wrote in a blog post on Thursday, March 2.
Email had hyperlinks to malware
The Sandbox wrote that they had become aware of the unauthorized access back on February 26. The third party in question accessed a number of email addresses, which then received an email supposedly from The Sandbox.
The email had the subject “The Sandbox Game (PURELAND) Access” and contained hyperlinks to fake sites, from which malware could self-install and gain control over the user’s device and personal information.
The Sandbox assured that the unauthorized party’s access was limited to just one employee’s computer, obtained via a malware application.
The Sandbox emailed notifications to all recipients and changed the compromised passwords on the employee’s computer.
What information was at risk?
Initially, just the email addresses of The Sandbox users were at risk, but that was not insignificant. Once malware was installed on their device, cybercriminals could access all other personal information.
The Sandbox took urgent measures:
Promptly after discovering the unauthorized access, The Sandbox emailed the known recipients of the false email informing them it was unauthorized and instructing them not to open, play, or download anything from the hyperlinked website. We have blocked the employee’s accounts and access to The Sandbox, reformatted the employee’s laptop, and reset all related passwords including requiring two-factor authentication. We have not identified any further impacts.
Players compete in The Sandbox to earn non-fungible tokens (NFTs). Sadly, the exciting game has fallen victim to a number of major phishing scams recently. CoinDesk reported that the pseudonymous scammer Monkey Drainer made away with NFTs worth almost $2 million in two hacks at the end of 2022.
