Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed

Well known cryptocurrency trade platform Coinbase disclosed that it knowledgeable a cybersecurity attack that focused its personnel.

The organization explained its “cyber controls prevented the attacker from gaining immediate method obtain and prevented any decline of resources or compromise of client facts.”

The incident, which took position on February 5, 2023, resulted in the publicity of a “restricted amount of money of info” from its directory, which includes staff names, e-mail addresses, and some phone figures.

As portion of the attack, numerous workforce were being focused in an SMS phishing campaign urging them to indicator in to their firm accounts to read through an critical message.

One particular personnel is said to have fallen for the rip-off, who entered their username and password in a phony login web page set up by the threat actors to harvest the qualifications.

“Just after ‘logging in,’ the staff is prompted to disregard the concept and thanked for complying,” the company reported. “What transpired subsequent was that the attacker […] produced recurring attempts to attain remote obtain to Coinbase.”

These attempts to log in to the programs working with the captured qualifications proved to be unsuccessful owing to the multi-factor authentication protections that have been enabled for the account.

Undeterred, the risk actor named the staff professing to be from the Coinbase company Data Technology (IT) team and directed the unique to log into their workstation and abide by a established of instructions.

“That commenced a back again and forth in between the attacker and an significantly suspicious employee,” Coinbase defined. “As the discussion progressed, the requests bought more and far more suspicious.”

The corporation explained it was alerted inside of the initial 10 minutes of the attack and that its incident responders attained out to the victim to inquire about the suspicious exercise from their account, prompting the individual to sever all communications with the adversary.

Coinbase did not elaborate on the specific recommendations the threat actor gave to the worker, but urged other organizations to be on the lookout for probable attempts to set up remote desktop software package this sort of as AnyDesk or ISL On-line as well as a genuine Google Chrome extension termed EditThisCookie.

It also warned of incoming phone phone calls and textual content messages from particular vendors like Google Voice, Skype, Vonage/Nexmo, and Bandwidth.

Coinbase even more famous that the attack is very likely joined to the advanced phishing marketing campaign regarded as 0ktapus (aka Scatter Swine) that targeted in excess of 130 businesses, which includes Twilio, Cloudflare, MailChimp, and Signal, among the many others, very last yr.

Identified this posting exciting? Adhere to us on Twitter  and LinkedIn to read through far more unique content material we post.

Some parts of this posting are sourced from:
thehackernews.com