A new and sophisticated phishing scheme has been identified, leveraging Google Ads to deceive Web3 users, particularly cryptocurrency enthusiasts. Initially targeting users of Pudgy Penguins NFTs, the scam underscores vulnerabilities in widely trusted ad networks while highlighting the broader risks it poses to the cryptocurrency community.
The scam came to light when ScamSniffer, a security research platform, responded to a report from a user who had been redirected to a fraudulent Pudgy Penguins website through an advertisement on a Singapore news outlet. Security experts traced the origin of the attack to malicious advertisements running on the Adloox tracking domain, distributed via Google Ads. These advertisements reportedly contained harmful scripts designed to exploit Web3 wallet users.
The embedded malicious code operates by scanning browsers for the presence of Web3 wallets and then redirecting users to fraudulent websites such as “pudqypenguin[.]com.” These fake sites are designed to extract wallet credentials from unsuspecting users. While the initial focus of the scam has been on Pudgy Penguins NFT users, security researchers caution that the methods employed in the attack could be easily adapted to compromise other NFT projects and cryptocurrency platforms.
Exploiting Vulnerabilities in Ad Systems
Further investigations revealed that the scam exploits a vulnerability in websites using Prebid.js, a widely-used header bidding library. Websites that incorporate the Adloox analytics module risk inadvertently running malicious scripts in their ad networks, potentially exposing visitors to malware infections.
Upon discovering the attack, security researcher ZachXBT quickly notified Adloox, prompting the company to remove the malicious JavaScript files from its content delivery network. This swift action helped mitigate further risks, though the broader implications of the attack remain a concern for Web3 users.
🚨 URGENT SECURITY ALERT 🚨
1/6 A user reported being redirected to a fake @pudgypenguins website through a Singapore news portal. Our investigation revealed this is part of a larger malicious advertising campaign. pic.twitter.com/Izv3f87WrX
— Scam Sniffer | Web3 Anti-Scam (@realScamSniffer) December 25, 2024
Expert Recommendations for User Protection
To counteract such sophisticated phishing attempts, cybersecurity experts recommend several protective measures for Web3 users. These include using ad blockers to prevent exposure to malicious ads, double-checking website URLs to ensure their authenticity, and segregating cryptocurrency-related activities by using dedicated browsers. Tools like ScamSniffer have also been highlighted as effective resources for identifying and preventing phishing threats.
A Global Concern for Crypto Security
The rise of such phishing scams reflects a growing challenge for the global cryptocurrency community. While these attacks have primarily affected users in specific regions, the broader implications extend internationally. For instance, France has witnessed a significant increase in cryptocurrency-related scams, with recent reports indicating that victims in the country lose an estimated €500 million annually.
French regulators have responded by intensifying efforts to combat these fraudulent activities. Measures include blacklisting approximately 5,000 platforms and blocking 350 websites involved in scams. Scammers are reported to employ a combination of social media campaigns, impersonation tactics, and AI-driven strategies to lure victims into fake investment schemes.
This latest phishing scam targeting Web3 users serves as a stark reminder of the ever-evolving nature of threats in the cryptocurrency space. As the industry grows, both users and platforms must remain vigilant and adopt proactive measures to protect against these sophisticated attacks.
