Bitcoin 
Ethereum 
Tether 
Solana 
BNB 
USDC 
XRP 
Dogecoin 
Lido Staked Ether 
TRON 
Cardano 
Toncoin 
Shiba Inu 
Wrapped stETH 
Wrapped Bitcoin 
Avalanche 
WETH 
Bitcoin Cash 
Chainlink 
Sui 
Polkadot 
LEO Token 
USDS 
Litecoin 
Uniswap 
NEAR Protocol 
Aptos 
Wrapped eETH 
Pepe 
Internet Computer 
Bittensor 
Artificial Superintelligence Alliance 
Dai 
Kaspa 
Monero 
Stellar 
Ethereum Classic 
Ethena USDe 
WhiteBIT Coin 
Stacks 
POL (ex-MATIC) 
dogwifhat 
First Digital USD 
OKB 
Aave 
Cronos 
Filecoin 
Arbitrum 
Mantle 
Render 
Immutable 
Celestia 
Injective 
Optimism 
Fantom 
Hedera 
THORChain 
VeChain 
Cosmos Hub 
Bitget Token 
Binance-Peg WETH 
Bonk 
Sei 
Popcat 
The Graph 
Jupiter 
Rocket Pool ETH 
FLOKI 
Pyth Network 
Mantle Staked Ether 
MANTRA 
Theta Network 
Worldcoin 
Solv Protocol SolvBTC 
KuCoin 
Gate 
Ethena 
Helium 
Maker 
Marinade Staked SOL 
Algorand 
Bitcoin SV 
Coinbase Wrapped BTC 
Renzo Restaked ETH 
Ondo 
Raydium 
Arweave 
Lido DAO 
JasmyCoin 
Brett 
Fasttoken 
Beam 
Aerodrome Finance 
Polygon 
Mog Coin 
BitTorrent 
cat in a dogs world 
Flow 
Bridged USDC (Polygon PoS Bridge) 
GALA 
Check Point Research (CPR) has discovered a “massive search engine phishing campaign” that has resulted in at least half a million dollars worth of crypto stolen from users.
“Over the past weekend, Check Point Research encountered hundreds of incidents in which crypto investors lost their money while trying to download and install well-known crypto wallets or change their currencies on crypto swap platforms like PancakeSwap or Uniswap,” CPR said.
“I just installed the phantom wallet and somehow I ended up downloading the scam,” one Reddit user said, adding, “I am somewhat new to wallets.”
The scam, CPR found, has also been hitting MetaMask and Phantom users, two popular crypto wallets, with scammers mimicking legitimate websites almost perfectly.
“Over the past weekend, researchers from CPR spotted multiple phishing websites that looked like the original website, because the scammers copied its design,” CPR added.
Phantom and MetaMask
For the Phantom domain, users were encountering phishing domains like “phanton.app” or “phantonn.app,” as opposed to the legitimate “phantom.app.”
The same was true of the scammers’ MetaMask tactics, which saw domains like “MètaMask” appear via Google ad campaigns. In the case of MetaMask, the scammers were also trying to steal user private keys to access their wallets.
“What makes this phishing campaign unique is the fact that the scammers are not sending phishing links via email like traditional phishing scams,” CPR said. “Instead, they are using Google ad campaigns to make their phishing websites appear before the original site when anyone searches the keyword,” the group added.
But what can users do to protect themselves? CPR has provided cautionary steps for crypto users.
These include looking at the first website in your search and ensuring that it is not an ad. Users, CPR suggests, should also never give out their passphrase.
Last but not least, CPR says, “always double-check the URLs.”