There has been a new cryptocurrency scam lure observed, impersonating WalletConnect Customer Support and targeting New Jersey State employees. The phishing email is sent from the Denmark “.dk” top-level domain (TLD), with a subject line of “Recovery Phrase Viewed,” followed by the date and a purported five-digit TicketID. It claims that the target’s wallet was viewed, urging immediate action to review their wallet security by clicking on the “Reconnect your Wallet” link.
If the link is clicked, the target is first directed to hxxps://reconnectyourwallet[.]birceadow[.]com/suspiciousnotice and then to tcsmc[.]com for a security verification to confirm the target is human. Once passed, they are redirected to steellking[.]net to select a wallet provider and connect their wallet through the misspelled “WalletKonnect” platform. If sensitive information, such as credentials and a recovery phrase, is submitted, the threat actors gain full access to and control over the associated cryptocurrency wallet. The threat actors can then transfer funds to a wallet under their own control, resulting in a total loss for the target.
Recommendations
- Avoid clicking links, opening attachments, responding to, or acting on unsolicited communications.
- Confirm messages from senders by verifying their contact information obtained from trusted, official sources.
- Type official website URLs into browsers manually and only submit account credentials, personal information, or financial details on official websites.
- Always refrain from sharing your private key, seed phrase, or secret recovery phrase with anyone.
- Keep systems and apps up to date.
- If victimized, monitor bank accounts, credit profiles, and other online accounts for irregularities or suspicious activity.
- Review the Identity Theft and Compromised PII NJCCIC Informational Report for additional recommendations and resources, including credit freezes and enabling MFA on accounts.
- Review the NJCCIC Cryptocurrency Scams webpage for additional information, recommendations, and resources.