Scammers leverage malicious ETH RPC nodes to target imToken wallet

by

As a researcher with extensive experience in the cryptocurrency and blockchain space, I find the recent scam targeting users via physical transactions involving USDT using a modified Ethereum RPC function deeply concerning. This scam not only exploits users’ trust and negligence but also highlights the importance of remaining vigilant during transactions.

A recent scheme aims to deceive individuals through in-person exchanges using USDT, taking advantage of an altered RPC function on Ethereum servers.

According to a report from cybersecurity company Slowmist released on April 26th, this deceitful scheme fools unsuspecting individuals into believing they have received free cryptocurrencies. The scam encourages them to download the authentic imToken wallet and distributes 1 USDT and small amounts of ETH as an allure.

As an analyst, I would advise that you be wary of receiving instructions to alter the Ethereum Remote Procedure Call (RPC) URL to an unfamiliar node. Such a modification could potentially place your Ethereum transactions under the manipulation of a malicious actor, who might be a scammer looking to exploit your trust and steal your digital assets. Instead, I would recommend sticking with a trusted and reputable RPC node or server to ensure the security and integrity of your Ethereum interactions.

As an analyst, I would describe an RPC (Remote Procedure Call) as a crucial tool that enables applications to connect and communicate with a blockchain. In the context of Ethereum, this RPC interacts directly with nodes, enabling tasks such as querying account balances, initiating transactions, or engaging with smart contracts, all vital components in the creation and functionality of decentralized applications (dApps).

As a researcher studying cybersecurity threats, I’ve come across a devious scheme involving modified RPC URLs. When a user alters this URL, they unknowingly receive a fabricated wallet balance on their end. This deception tricks them into thinking they have received a significant influx of funds.

Researchers at Slowmist caution that while checking if funds have been deposited into your digital wallet is important, it’s equally essential to be aware of potential risks. Criminals can exploit your trust and carelessness by employing convincing methods such as transferring small sums of money to deceive you.

One finding from Slowmist’s investigation was that a victim’s wallet contained a transaction from the scammers’ address, receiving 1 USDT and 0.002 ETH. By tracing this address further, it was discovered that the scammer had transferred 1 USDT to three other wallets.

I’ve noticed that the address linked to the suspicious activity was connected to various trading platforms. Additionally, this address has been identified as “Pig Butchering Scammers” according to the on-chain monitoring tool, MistTrack.

Slowing down the pace, Slowmist advised users to stay alert when conducting transactions and exercise caution when dealing with others to minimize the risk of falling victim to fraudulent activities.

Cryptocurrency scams persistently pose a threat to market participants, even as awareness grows. In the month of April alone, there were several incidents in which scammers successfully defrauded unsuspecting crypto users.

On April 17th, the social media account of renowned Hollywood actor Tom Holland, specifically his X platform, was compromised and used to advertise crypto scams. Previously in the month, YouTube experienced a surge of false SpaceX giveaways disguised as live streams centered around the solar eclipse on April 8th.

Read More

2024-04-26 13:08