Security services alert users to concealed phishing and wallet-draining links.

With millions of dollars in assets lost to phishing schemes after users authorize harmful permissions, the risk of losing cryptocurrency through dubious links is quite significant. When these links are combined with platforms that permit concealed links, users face an additional layer of danger.

On September 4, Web3 security firm Pocket Universe revealed how fraudsters can conceal wallet-draining links within any text on the messaging platform Discord. While some users have noted that this feature has only recently been activated for Discord users, the capability to embed links in various texts has been present on numerous social media platforms for some time.

Scammers can now hide links in any discord text ☠️
Be cautious of concealed wallet drainer links
e.g. pic.twitter.com/mgqG18sOF9

— Pocket Universe (@PocketUniverseZ) September 4, 2023

Cointelegraph contacted several cybersecurity experts to gain insights on how users can safeguard themselves against such threats and how platforms can enhance their security to prevent users from falling victim to these attacks.

Christian Seifert, a researcher at Web3 security company Forta Network, stated that this form of attack has been a staple for hackers since the inception of the internet. He elaborated:

“Whatever a platform develops, there will always be a hacker ready to exploit it. Hyperlinks with text are a feature supported as part of HTML and have been a source of phishing attacks since the early days of the internet.”

Seifert emphasized that security necessitates a comprehensive defense strategy. “Both platforms and users must collaborate to ensure their protection,” he remarked. From the user perspective, he pointed out that there are plugins available that can help shield them from such scams.

Regarding Discord, Seifert noted that the platform does provide information about the actual destination of the URL after a user clicks on it. However, it also permits users to “trust” a domain for future interactions. This feature can be exploited by scammers, according to Seifert. He explained:

“Consider a domain like foo.bar, which the user has trusted. A scammer can create a potentially harmful link that executes some action on this domain, such as an ‘oauth’ request to the scammer, like foo.bar/oauth/scammer-account.”

The cybersecurity expert mentioned that a flaw in the platform’s current setup is that links and text can be misleading and not align with users’ expectations. “If a text link closely resembles a domain or URL but does not match the actual destination URL, Discord should prohibit such links,” he added.

Related: Exploits, hacks and scams stole almost $1B in 2023: Report

Meanwhile, Hugh Brooks, director of security operations at the blockchain security firm CertiK, echoed some of Seifert’s views. Brooks stated that both users and platforms share a collective responsibility to be vigilant against malicious actors. He emphasized the importance of platforms continuously assessing and enhancing their security features while users remain alert and informed.

For users, Brooks advised that they should be proactive and cautious regarding links, particularly when asked for signatures and permissions. He urged users to verify the legitimacy of the website address before granting access to their crypto wallets. Brooks suggested:

“A good practice is to cross-check web addresses with recognized phishing warning lists. PhishTank, Google Safe Browsing, and OpenPhish are valuable resources, along with browser extensions like HTTPS Everywhere and ad blockers like uBlock.”

Brooks explained that these tools can notify users in real time when they are about to visit known phishing or harmful websites. “Additionally, by simply hovering over a URL link, the actual web address will be displayed, allowing users to verify its authenticity before proceeding,” he added.

On the platform side, the cybersecurity expert mentioned that measures could be implemented, such as allowing users to receive messages only from trusted contacts. Brooks cited Meta’s “Facebook Protect” as a good example, which provides users with enhanced security features for their accounts.

“As the saying goes, the only constant is change. Platforms owe it to their users and their ongoing relevance to prioritize security. This entails not only updating security measures but also cultivating a culture of vigilance and awareness among users,” he concluded.

Magazine: Should crypto projects ever negotiate with hackers? Probably