Select Page

Cyren Security Blog

Discord Attack Targets NFT Projects

Multiple Targets 

Discord Administrators/Moderators and NFT project members were targeted today in a well-planned social engineering attack. Attackers managed to take over sessions of some privileged Discord accounts and used them to send messages to servers/users in Discord. Since the messages and announcement came from moderators’ accounts, it is likely that users will trust the content of their messages. 

As narrated by kekwin.eth on twitter, the threat actors were able to grab the session token of his Discord account by luring him to a screen sharing session. From that point, it only took a screen grab of the Developer Tools logs in Discord to bypass authentication, including 2FA, and take control of the account.  

Axie Infinity Fake Announcement 

A fake announcement was sent to the official Axie Infinity Team Discord channel. Though the announcement was retracted as fast as the admins/moderators could, a couple of fast users were able to click on the links and were duped into purchasing a fake NFT for Axie Infinity. 

 

Fake Axie announcement

As stated on their Discord channel, a staff member was similarly tricked into giving away his Discord access through the network logs of Chrome’s Developer Tools.

discount announcement

The image above is of the notice from Discord of the hacked staff member account; note the similarity to kekwin.eth incident.

It’s likely that the attacks are by the same group since they have very similar approaches and close timelines. Although steps have been taken to secure Discord channels and accounts, threat actors are always finding ways to trick unsuspecting users. If users train to learn how to secure their accounts and follow security guidelines, it could lead to a more stress-free online experience.

Reference:

https://twitter.com/kekwin7/status/1454902689029103618

https://twitter.com/notthetechguy/status/1454332297285492742

https://twitter.com/Zeneca_33/status/1450695495232462849/photo/1

https://twitter.com/fiveoutofnine/status/1450705651508776967

IOC:

https[:]axieinfinities[.]com

You might also like

How to Stop Phishing Attacks: Techniques, Tips & Tricks

Every IT admin has asked themselves, “How can I stop phishing attacks?” Phishing is unfortunately one of the most common, effective, and damaging attacks hackers use to break into bank accounts, steal data, steal money and overall - scam your company. Phishing attacks...

LinkedIn Phish Kit

Scam Warning Back in January, LinkedIn posted a warning about connection requests from individuals impersonating employees of a legitimate organization. These requests come from newly created accounts. If someone accepts the request, the attackers will have more...