Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed

Well known cryptocurrency trade platform Coinbase disclosed that it expert a cybersecurity attack that specific its workforce.

The company mentioned its “cyber controls prevented the attacker from getting immediate program access and prevented any decline of cash or compromise of purchaser data.”

The incident, which took area on February 5, 2023, resulted in the exposure of a “limited volume of information” from its listing, including staff names, e-mail addresses, and some phone numbers.

As portion of the attack, many staff were being targeted in an SMS phishing marketing campaign urging them to indication in to their business accounts to examine an significant concept.

A single employee is mentioned to have fallen for the scam, who entered their username and password in a bogus login site set up by the menace actors to harvest the credentials.

“Immediately after ‘logging in,’ the personnel is prompted to disregard the message and thanked for complying,” the enterprise explained. “What happened subsequent was that the attacker […] made recurring makes an attempt to gain distant obtain to Coinbase.”

These attempts to log in to the techniques using the captured qualifications proved to be unsuccessful owing to the multi-element authentication protections that had been enabled for the account.

Undeterred, the threat actor named the staff boasting to be from the Coinbase company Details Technology (IT) team and directed the person to log into their workstation and observe a established of directions.

“That began a back and forth among the attacker and an increasingly suspicious personnel,” Coinbase stated. “As the discussion progressed, the requests got much more and a lot more suspicious.”

The business explained it was alerted within the initially 10 minutes of the attack and that its incident responders arrived at out to the target to inquire about the suspicious action from their account, prompting the person to sever all communications with the adversary.

Coinbase did not elaborate on the precise instructions the threat actor gave to the staff, but urged other companies to be on the lookout for probable makes an attempt to set up distant desktop software program such as AnyDesk or ISL On the internet as effectively as a legit Google Chrome extension named EditThisCookie.

It also warned of incoming phone calls and textual content messages from specific vendors like Google Voice, Skype, Vonage/Nexmo, and Bandwidth.

Coinbase further more noted that the attack is probable linked to the innovative phishing marketing campaign recognized as 0ktapus (aka Scatter Swine) that targeted over 130 providers, which include Twilio, Cloudflare, MailChimp, and Sign, amongst other folks, past calendar year.

Identified this write-up interesting? Follow us on Twitter  and LinkedIn to read through additional exceptional articles we post.

Some parts of this article are sourced from:
thehackernews.com