The attack is the latest in a long string of exploits targeting users on Discord with fake “stealth” NFT drops.
Hong Kong-based gaming and venture capital company Animoca Brands and subsidiary Blowfish Studios have promised users that they will repay 265 Ether (ETH) or $1.1 million stolen in a fraudulent nonfungible token (NFT) sale on Discord.
The fraudulent minting event occurred at approximately 3 am Australian Eastern Daylight Time on Friday on the Phantom Galaxies Discord server. It saw 1,571 fake minting transactions over the course of about three hours.
Phantom Galaxies is an upcoming Australian game being developed by Blowfish Studios. The Phantom Galaxies Discord server has 94,000 members.
In an increasingly common occurrence on Discord, hackers gained control of the official Phantom Galaxies server by using a malware bot that compromised the Admin account’s two-factor authentication. Once in control of the Discord server, the hackers banned all staff, advisor and community moderator accounts.
Screenshot of a fraudulent announcement about the so-called NFT drop. Source: PhantomGalaxies Discord server
The hackers then began posting announcements, claiming that the game was launching an immediate surprise “stealth” NFT minting event. Users were directed to a fraudulent “Phantom Galaxies NFT minting platform” that charged users a 0.1-ETH “minting fee.”
Screenshot of the fraudulent website where users could “mint” PhantomGalaxies NFTs
Animoca Brands chairman Yat Siu warned followers about the fraudulent NFT drop in a tweet at around 4 am AEDT on Friday.
At 5:22 am he posted another tweet, saying that affected customers will be “appropriately compensated.” This has since been confirmed in a Wednesday release from Animoca stating that details regarding compensation will be announced shortly.
“Woodz,” a Californian project manager for an upcoming NFT project called Terra Obscura, lost $1,000 to this attack. They told Cointelegraph they realized they’d been scammed shortly after “minting” two non-existent NFTs:
“As I was doing it, it seemed a bit off. The gas was unusually low, and the contract looked different. I knew something was wrong but not sure what.”
Woodz added they “don’t normally just click links” but fell into the hacker’s trap because of the way the announcement was positioned inside the official announcement channel.
Related: Beeple’s Discord compromised, timed to coincide with Christie’s auction
The attack on Phantom Galaxies comes after a similar recent attack on Nov. 11 involving famed NFT artist Beeple. Users thought they were signing up for a very affordable NFT drop, timed to coincide with his second Christie’s auction.
The perpetrator impersonated one of the channel admins and the Beeple Announcements Bot to promote a fake NFT drop from Beeple on Nifty Gateway. Beeple has since removed links to the Discord from his Twitter profile, and other links to the server no longer appear not to work.
According to an Oct. 21 report by cyber security company RiskIQ, Discord is becoming an increasingly popular platform for cybercriminals. RiskIQ researchers uncovered 27 unique malware types hosted on Discord’s CDN servers.
In April, Talos Intelligence similarly found that hackers were increasingly using platforms such as Discord to take advantage of users who were at home due to global COVID-19 restrictions.
“Attackers are leveraging collaboration platforms, such as Discord and Slack, to stay under the radar and evade organizational defenses,” it wrote at the time.
