How Twitter Scammers are Exploiting Crypto Projects and Users

Twitter is one of the most popular social media platforms for the cryptocurrency community, where projects and users can interact and share information. However, it is also a breeding ground for phishing scams that target both projects and users, according to a recent report by the SlowMist Security Team.

The Rise of Phishing Scams on Twitter

Phishing scams are a type of cyberattack that aim to trick users into revealing their personal or financial information, such as passwords, private keys, or wallet addresses. These scams often use fake websites, emails, or messages that mimic legitimate sources, such as well-known projects, exchanges, or influencers.

According to the SlowMist Security Team, phishing scams have become rampant on Twitter, especially in the comment sections of tweets from famous projects. The team said that approximately 80% of comments on tweets from famous projects are occupied by phishing scam accounts. These accounts use various tactics to deceive users into clicking on malicious links or sending funds to fraudulent addresses.

How Scammers Operate on Twitter

The scammers behind these phishing attacks have developed a sophisticated system to acquire and manipulate Twitter accounts, as well as to promote their scams and evade detection. The SlowMist Security Team explained the modus operandi of these scammers in detail:

• First, the scammers purchase Twitter accounts from various sources, such as Telegram groups or dedicated websites. These accounts vary in terms of follower counts, post history, and registration dates, making them appear more or less legitimate to unsuspecting users. Some of these accounts even mimic the usernames of well-known projects, creating a false sense of trust. For example, a fake account called “Optimlzm” may try to deceive users into believing it is the real “Optimism” account.
• Second, the scammers employ promotional tools to boost their credibility. These tools allow scammers to buy followers, likes, and shares for their accounts, further enhancing their appearance of legitimacy. These services, which often accept cryptocurrency as payment, have processed millions of orders, demonstrating the scale of this illicit industry.
• Third, the scammers proceed to mimic the information found in legitimate project accounts. They carefully monitor the activities of well-known projects and use automated bots to ensure that their comments appear first under project tweets. By capitalizing on the trust placed in these projects and the similarity between their fake accounts and the genuine ones, scammers can deceive users into clicking on phishing links and unknowingly authorizing malicious transactions.

An Example of a Phishing Scam on Twitter

An example of this deceptive tactic occurred when the official Optimism Twitter account posted a tweet earlier this month. The first comment under the tweet, which received high interaction, was from a phishing group and included a link to their “official website.” However, a closer examination of the link revealed it to be a phishing link, cleverly disguised to appear legitimate. In a warning, SlowMist CISO highlighted the prevalence of these phishing accounts in project comment sections.

How to Protect Yourself from Phishing Scams on Twitter

Phishing scams are not only a threat to individual users, but also to the reputation and security of the cryptocurrency industry as a whole. Therefore, it is important to be vigilant and cautious when interacting with Twitter accounts and links, especially those related to cryptocurrency projects. Here are some tips to help you avoid falling victim to phishing scams on Twitter:

• Always verify the authenticity of the Twitter account you are following or interacting with. Check the username, profile picture, bio, and verified badge (if any) of the account. Be wary of accounts that have similar usernames or profile pictures to well-known projects, but with slight variations, such as “Optimlzm” instead of “Optimism.”
• Always double-check the URL of the website or link you are clicking on. Look for spelling errors, unusual characters, or suspicious domains, such as “optimism.io” instead of “optimism.network.” Use a reputable browser extension or tool that can detect and block phishing websites, such as MetaMask or Etherscan.
• Never reveal your personal or financial information, such as passwords, private keys, or wallet addresses, to anyone on Twitter or any other platform. No legitimate project, exchange, or influencer will ever ask you for such information. If you receive such a request, report it as spam or phishing immediately.
• Never send funds to any address or account that claims to be associated with a project, exchange, or influencer, unless you have verified its legitimacy. Many phishing scams promise rewards, giveaways, or airdrops in exchange for sending funds, but these are almost always scams. Do not fall for such offers, no matter how tempting they may seem.

By following these simple steps, you can protect yourself and your funds from phishing scams on Twitter and other platforms. Remember, if something sounds too good to be true, it probably is.