Cryptocurrency wallets MyEtherWallet and Electrum are now attacked and users are faced with phishing attacks. The news was broke on Reddit. The phishing attack tries to obtain user data through illicit means. Attackers are disguising trusted entities or send messages with malicious links. After being clicked, the link will ask for personal data or will install malware.
MyEtherWallet recently tweeted about the current threat, saying there was a phishing email that was being sent to users, in an attempt to get them to disclose personal account information. The statement was:
Attention #MEWfam,
There’s another phishy email going around asking users to give up personal information. Don’t believe the hype!
#1. We will never email you first (only reply to support).
#2. We will never ask for your private key (or other sensitive info).
#3. Be skeptical!
A Reddit user investigated and saw the phishing scam trying to steal Electrum customers’ sensitive data while posing as an important security update. The message is received by the user and it is allegedly from Electrum wallet, claiming there is a need to update the wallet to Electrum 4.0.0. The latest wallet version is 3.3.3. Obviously, release announcements will always come from Electrum and be signed, with hardcoded Bitcoin address added.
In the Reddit thread there was a user that said this attack is:
the second cluster of reports of the same phishing, and the first one was at the end of December 2018.
It was also added that the “would-be hacker” possibly has over 100 GitHub accounts.
After the reports, Electrum published a website warning, warning all users that Electrum wallet versions older than 3.3.3 can be attacked by phishing as malicious servers display messages in which users are asked to download a fake Electrum version. Electrum warned users to only download software updates from official sources.
