What happened
The Ukrainian hacker group Coinhoarder stole more than $50 million worth of cryptocurrency from the well-known cryptocurrency wallet Blockchain.info, according to a report by Cisco’s information security subsidiary Talos.
The report describes how hackers used a "very simple" but very dangerous technique to deceive victims. Hackers buy cryptocurrency-related keyword ads on Google’s search engine, “poison” users’ search results, and then steal assets from cryptocurrency wallets. This means that when people search for keywords such as "blockchain" or "bitcoin wallet" on Google, they will see links to malicious websites masquerading as legitimate websites.
These malicious links may be "blockchien.ino/wallet" or "block-clain.info". After clicking on these links, the user is taken to a landing page that mimics the real website. According to Cisco's report, genuine websites rank lower than malicious links in Google's search engine rankings.
Protocol details
Evidence
- report Report tech.sina.com.cn
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
