The Proofpoint Threatinsight blog reported on something curious. They called their posting "Curiosity Clicks: Using Bitcoin’s hype for phishing fun" and came up with some interesting statistics.
To begin with, the world of the new crypto currency Bitcoin is unregulated and designed for anonymity. It represents an attractive, $6.8 billion target to cyber criminals.
Blockchain.info, the most popular Bitcoin "wallet" web site, reports that since September 2013 the number of "My Wallet" users has grown over 500% to over 2 million users, and daily transactions have nearly tripled to over 30,000 transactions per day. A percentage of these are ransomware victims transferring money to cyber criminals hoping to get their files unlocked.
Phishing Expeditions
The bad guys go where the money is, so with numbers like this, phishing attacks targeting Bitcoin users are literally "phishing expeditions." Attackers have used lists of known/active Bitcoin users and used widespread misperceptions about Bitcoin to try and improve their odds of success.
They drilled down into a specific Bitcoin 'themed' phishing campaign and found that the 12,000 messages part of this campaign received a 2.7% click rate, which is more than the percentage of Bitcoin users in the general population.
Curiosity Killed The Cash
The conclusion is simple. It means that in some cases the link pointing to the phishing website was accessed by users that did not even have a Bitcoin Wallet, highly likely out of curiosity about the digital currency.
The phishing emails used a classic phishing strategy, a bogus alert of a suspicious sign-in attempt. To make sure that no Bitcoins are stolen, a password reset is recommended with a link to do that at the end of the message.
The messages claim to be from a Bitcoin related website called Blockchain.info and give a case number for the "incident", a classic social engineering tactic.
If the victim clicks the link, they land on a phishing site impersonating the Blockchain log-in page and any information entered in the fields is sent directly to the phishers. Once the bad guys that data they can login to the user’s real Blockchain.info account and empty it out. "Because Bitcoin transactions are by design irreversible and difficult to trace, the victim has almost no recourse for their loss,” says Proofpoint.
New KnowBe4 Phishing Template
To test end-users and make sure their curiosity does not get them to click on Bitcoin-related phishing attacks, KnowBe4 has a new template in the Banking category, which uses a similar approach to what the bad guys did, however, the "access attempt" comes from Russia instead of China. Send this to your users and inoculate them against Bitcoin-related attacks. If you do not yet use simulated phishing attacks to your users to protect your network, find out how affordable it is for your organization.
