- The scheme hacked the verified Twitter accounts of renowned journalists and media personalities.
- Attackers used phishing emails that seemed to come from Twitter’s support team to compromise the accounts.
- The bad actors asked their targets to click on a link and connect their Ethereum wallets to get Beanz NFTs.
Twitter fraudsters have created a scheme targeting Ethereum wallet holders interested in non-fungible tokens (NFTs). A report unveiled this news earlier today, noting that the hackers hacked into the accounts of verified Twitter users to promote a fake Azuki NFT airdrop.
According to the report, the scammers targeted accounts belonging to journalists and media personalities. After getting access to the accounts, the scammers changed the images and text on the profiles to make them appear like those of Azuki’s co-creators. However, it is worth noting that the project’s real creators at Chiru Labs all go under pseudonyms.
After compromising the accounts and changing the details, the hackers tweeted out a link promising a secret airdrop of Beanz. Beanz is free NFTs that Chiru Labs gave out to Azuki NFT holders in the past week.
The tweet directs NFT collectors to click the link to claim a Bean. Upon clicking the provided link, users are instructed to connect an Ethereum wallet. Unwitting users that follow these instructions end up losing NFTs in their wallets. As expected, they also don’t receive any Beanz NFTs.
Among the compromised accounts was that of Emily Buder, the Senior Editor at Quanta Magazine. The bad actor controlling her account kept her name intact but updated her profile picture with an Azuki avatar and changed her bio to co-creator of Azuki.
The tweet sent out from her account read,
Shh Secret Airdrop.. For the next 24 hours we are airdropping Beanz to all active NFT traders in the community! The Beanz will no longer be claimable after they have all been airdropped. Good Luck! #Azuki Claim A Bean azuki.team Welcome To The Garden.
Attackers used phishing emails to hack into verified Twitter accounts
In at least two confirmed cases, the owners of the compromised Twitter accounts admitted that the bad actors got access to their accounts through phishing emails, which seemed to originate from Twitter’s support time.
One journalist that wished to remain anonymous said their account sent out over 6,000 tweets after being compromised. According to the journalist, almost all 6,000 tweets tagged several potential victims that the scheme targeted.
This attack is similar to the ApeCoin (APE) scam, which saw bad actors walk away with NFTs worth over $1 million. The ApeCoin scam promised to airdrop APE to users that clicked a provided link and attached a wallet to the page associated with the URL. As a result, anyone that interacted with the scam lost their digital collectibles.
