KrebsOnSecurity reports that a phishing website has been impersonating the private messaging service Privnote.com in order to steal Bitcoin. The real Privnote is a free site that allows users to send encrypted messages that are automatically erased after being read. The owner of Privnote contacted Krebs in February telling him that someone had created a copy of their site at the domain “privnotes[.]com.” The spoofed site contained a messaging service, but the messages were sent in plain text and could be read or modified by the site’s operators. And the bogus domain name was just one character off.
It wasn’t clear what the spoofed site’s intent was until Krebs found that it contained a script that would automatically replace Bitcoin addresses in messages composed by users with an address presumably controlled by the site’s owner. Allison Nixon, chief research officer at Unit 221B, told Krebs that the nature of the site made it easier for this scam to remain undetected for months.
“Because of the design of the site, the sender won’t be able to view the message because it self destructs after one open, and the type of people using privnote aren’t the type of people who are going to send that bitcoin wallet any other way for verification purposes,” Nixon said. “It’s a pretty smart scam.”
Krebs notes that Privnotes[.]com appeared as the second Google result for “privnote,” and the scammers even paid for deceptive Google ads so that their site would show up at the top of the search results with the title “Privnote.”
“Even if you never use or plan to use the legitimate encrypted message service Privnote.com, this scam is a great reminder why it pays to be extra careful about using search engines to find sites that you plan to entrust with sensitive data,” Krebs writes. “A far better approach is to bookmark such sites, and rely exclusively on those instead.”
New-school security awareness training can teach your employees to pay close attention to URLs and other indicators of legitimacy, especially when they’re entering sensitive information.
KrebsOnSecurity has the story: https://krebsonsecurity.com/2020/06/privnotes-com-is-phishing-bitcoin-from-users-of-private-messaging-service-privnote-com/
Here's how it works:
