Threat Actors use NameCheap’s Email to Execute Metamask and DHL Phishing Attacks.

The recent security breach and phishing campaign that occurred at Namecheap, a domain registrar, serves as a stark reminder of the persistent and evolving threats posed by cybercriminals. In this post, we will delve into the details of the breach and the phishing campaign and offer some essential tips to help protect against phishing scams.

The web hosting company and domain registrar Namecheap recently suffered a security breach when its email account was hacked. This breach resulted in a phishing campaign that targeted the cryptocurrency wallet MetaMask and the logistics company DHL, intending to obtain personal and cryptocurrency wallet information from susceptible users.

The phishing emails were sent out around 4:30 PM ET and originated from SendGrid, an email platform that Namecheap had used in the past for marketing emails and renewal notices.

 

 

Phishing Emails

The phishing emails used in the campaign impersonated DHL and MetaMask. The DHL phishing email appeared to be a bill for a delivery fee needed to complete the package delivery. The embedded links in the email directed users to a fake phishing page where the attackers aimed to steal the targets’ information.

Meanwhile, the MetaMask phishing email was designed to appear as a required KYC verification message to prevent wallet suspension. The email included a marketing link from Namecheap that redirected users to a phishing page pretending to be MetaMask.

This page prompted users to enter their “Secret Recovery Phrase” or “Private Key.” Once a user provides either the recovery phrase or private key, the threat actors could use them to import the wallet to their devices and steal all the funds and assets.

After several recipients voiced their complaints on Twitter, Namecheap’s CEO Richard Kirkendall confirmed that the account was compromised and that they had disabled the email through SendGrid while they conducted an investigation.

 

What are Phishing Emails?

Phishing emails are deceptive emails that deceive recipients into sharing sensitive information like login credentials, credit card numbers, or other personal information. Phishing emails often appear to be from legitimate sources, such as a bank or a company that the recipient is familiar with, and may use a variety of tactics to make the email appear more convincing, such as including official logos or using a tone of urgency.

Phishing attacks can take various forms, such as spear-phishing, where the attacker targets a specific individual or group, or whaling, where the attacker targets a high-profile individual, such as a CEO or a government official. Social engineering tactics and machine learning algorithms have been increasingly used in phishing attacks in recent years to personalize email content and make them harder to detect.

 

 

The latest research by Checkpoint highlights a significant surge in cyberattacks on corporate networks worldwide. Shockingly, the number of cyberattacks increased by an alarming 38% per week in 2022 compared to the previous year. This worrisome trend is further exacerbated by multiple cyber threat factors occurring simultaneously.

The threat landscape posed by ransomware is evolving at a rapid pace. Cybercriminals have expanded their focus and are now targeting widely-used business collaboration tools like Slack, Teams, OneDrive, and Google Drive to launch phishing attacks and gain access to sensitive data.

These groups are well-organized, highly skilled, and capable of developing and deploying advanced techniques to evade detection, bypass security controls, and infiltrate targeted systems. As these groups become more refined in their methods, techniques, and procedures, their attacks are becoming increasingly difficult to thwart, requiring the implementation of more advanced and multifaceted defensive strategies.

 

Namecheap’s Response to the Recent Attack

In a statement released on Sunday night, Namecheap clarified that their own systems were not breached, but rather the phishing incident was related to an upstream system used for email. Namecheap suspended all email services, including two-factor authentication code delivery, trusted devices’ verification, and password reset emails, as a precautionary measure.

The company initiated an investigation in collaboration with its upstream provider to determine the source of the attack. By 7:08 PM EST, services were restored.

Namecheap has not explicitly mentioned the name of the compromised upstream system. However, the CEO of Namecheap had previously tweeted that the company was using SendGrid, which was also confirmed in the headers of the phishing emails. Interestingly, Twilio SendGrid, the email service provider, denied any hack or compromise of their systems in relation to Namecheap’s incident, creating more confusion about the cause of the breach.

 

Protecting Yourself from Phishing Scams: Essential Tips

Phishing scams are a major threat in the cybersecurity world, and it’s essential to take proactive steps to protect yourself and your organization. The following are some essential tips to keep in mind:

 

 

1. Be cautious of unsolicited emails asking for personal information: Phishing emails often appear to come from legitimate sources but are actually from fake or spoofed email addresses. Therefore, it is critical to double-check the sender’s address before providing any personal information.
2. Exercise caution when clicking on links or downloading attachments included in phishing emails: Links or attachments in phishing emails can contain malware or take you to a fake website designed to steal your information. It is vital to exercise caution and avoid interacting with any suspicious emails or links.
3. Watch out for urgent or threatening language: Phishing scams frequently employ tactics that induce a feeling of urgency or panic, with the intention of pressuring individuals to take swift action without careful consideration. Be cautious of any emails that use such language, and double-check the sender’s legitimacy.
4. Use two-factor authentication (2FA): To enhance your online security, it is advisable to enable two-factor authentication (2FA) for all your accounts. It can help prevent unauthorized access even if a scammer has obtained your login credentials. It’s important to set up 2FA wherever possible to enhance the security of your accounts.
5. Keep your software updated: Software updates often include security patches that can protect against known vulnerabilities that scammers may exploit. Therefore, it’s essential to keep your software up to date and ensure that all security patches are applied.
6. Use anti-virus and anti-malware software on your devices: Installing anti-virus and anti-malware software on your device can aid in identifying and eliminating any potentially malicious software that may be installed on your device. It’s crucial to use such software and keep it up to date to protect against potential cyber threats.
7. Get educated on phishing scams: Phishing scams can be sophisticated, and it’s crucial to stay informed about the latest tactics used by scammers. Educate yourself and your employees about phishing scams and how to identify and avoid them. This can help prevent potential security breaches and protection from phishing.

 

Final Words

The Namecheap email breach is a timely reminder of the importance of maintaining good cyber hygiene and being vigilant regarding online security. Taking proactive measures to protect yourself and your organization from phishing scams is essential.

 

 

Following the essential tips outlined in this blog can help reduce the risk of becoming a victim of a phishing scam and keep your personal information and assets safe. Remember, staying informed, remaining cautious, and practicing good cyber hygiene are critical to staying safe in the digital world.