Hackers Steal Metaverse Investors’ Digital Assets With Phishing Scams

Metaverse, the digital world and the future of the Internet where users can immersively interact with each other, and purchase digital properties such as houses, and land, has been hit with Cyber fraud. 

A fitness instructor in Colorado, who is also a nurse in rural Main and a venture capitalist in Florida. Made a solid investment in the Metaverse, and bought virtual land. She said in an interview with CNBC “I was really excited about it and hopeful for, you know, whatever projects that would come out of it.”

After a few months of investing in the Metaverse, all the virtual land invested in, vanished, and she said there was no way to get it back.

According to authorities and interviews hosted featuring the victims of this cyber fraud and cybersecurity experts. The fast-rising people interested in the Metaverse has increased and has also increased the popularity of investments made in the Metaverse. And Investments such as users purchasing a digital asset— virtual lands, have been hit with a new tech of phishing scams. 

Metaverse Investors across the world who have made a solid investment in the Metaverse because of some significant from celebrities, fashion shows, and other influential investors, said these cyber frauds have taught them the dangers of high-risk investing. This happened when their lands were stolen by hackers by tricking them into clicking a phishing link which Is disguised to be a portal to the actual virtual world.

A Quick Summary of What The Metaverse Is

The Metaverse is more than a virtual world where we could all immersively interact with each other in the digital space with our avatar representing us. The Metaverse is also a digital space where you could buy and own digital assets such as virtual cars, houses, lands, and so on, which can be purchased using cryptocurrencies. Metaverse also makes it possible to attend virtual meetings or concerts, right from in front of your computer screens or wearing a VR headset.

Hackers Use Phishing Links

While VR tech is used to enter the Metaverse with a headset, the purchasing of digital assets can only be done or accessed through a computer. And the most used platforms used to purchase virtual real estate and digital assets are Decentraland, Sandbox, and SuperWorld. Purchasing virtual real estate in the Metaverse is similar to how real estate is also being purchased in the real world. To purchase real estate in the Metaverse, users need a Cryptocurrency wallet in which the payment will be made. Users in the metaverse also make bids on digital properties such as virtual plots of land through NFT marketplace like OpenSea, to trade their digital assets.

Kash Deriosers said she got interested solely in the Metaverse when the nurse invested $16,000 in plots of land in The Sandbox and SuperWorld, hoping to use the virtual platform to develop an educational game on physiology and human anatomy.

Dick Desrosiers, Kasha’s husband, who was also involved in the investment said, “It was kind of like a new frontier”  But her dreams of virtual science education vanished. After three months of solid investment in the Metaverse, Kash Deriosers said she typed in the name of the virtual platform she uses, which was Decentraland on the Google search bar, the result came out, she saw the first link that looked exactly like the virtual platform she typed, she clicked the link not knowing it was a phishing link, and it erased all the investments in her Metamask wallet. 

An online fitness instructor based in Boulder, named Tracy Carlinsky also experienced a similar incident. Carlinsky spent about $20,000 on virtual land in the Metaverse using the Sandbox virtual platform after hearing the hype about the metaverse. And also like Desrosiers, Carlinsky said she also mistakenly clicked on a phishing link disguised and look identical to the Sandbox’s login page and lost all her land. 

According to Chainalysis, phishing scams are getting rampant. Decentraland was also a victim of a phishing attack that targeted MailChimp, and as a result, hundreds of email accounts were leaked to the hacker. 

There has also been some illegitimate business going on. On the dark web and chat platforms such as telegram, there have been some advertising and selling of phishing pages and imposter sites for $400, while others sell for as much as $5,000.

When investors type in their Metamask details into one of these phishing pages or imposter websites, their username and password go to the hacker, allowing them to withdraw all the digital assets in the wallet. The hacker can then resell the stolen asset on an online marketplace like OpenSea.

Wrapping up

Although Metaverse platforms are increasing their security measures and educating their users about the prevention of fraud. They also said they are, and would not be responsible for refunding investments lost to the phishing scams made by hackers to the victims of these phishing scams.

Adam Lowe, the creator of the cold storage wallet Arculus, recommends investors use multifactor authentication to increase the protection and security measures of their wallets. 

Metamask has begun to take action regarding these scams by providing victims with better customer services to recover their stolen funds. Metamask partnered with Asset Reality, to be the case handler to investigate complaints made by customers who have been a victim of phishing scams.

Virtual platforms such as Sandbox is also working on way to eliminate phishing sites by contracting with companies that are capable of this. 

Sandbox said in an email “We take security very seriously. Unfortunately, these fake sites are a typical phishing scam that affects all industries. To combat these scammers, we have constant monitoring, using Brandshield and other providers to take proper legal actions and remove these sites”

Super world did not prove any point to take down phishing sites, instead, the company made a statement that it is making more efforts to educate customers on the best practices for preventing and avoiding cyber frauds.