Hackers Breach Namecheap’s Email to Send Phishing Links

Namecheap, an ICANN-accredited domain name registrar and Web 3.0 hosting company, known for offering domain name services including domain registration, transfer, and renewal, as well as domain privacy protection among other services is out warning the crypto community to be vigilant against “phishing campaigns”.

According to a Tweet on February 13, the US-based company’s email account which is majorly used for sending mail to customers was breached by hackers. As discovered by the firm, the hackers started sending phishing campaign emails to clients posing as DHL and crypto wallet MetaMask in an attempt to steal crypto from millions of its users.

 Upon discovery, Namecheap immediately stopped the scheme and subsequently investigated. The attack was later traced back to SendGrid, the email site used by Namecheap.

How the Phishing Campaign Works

Unlike traditional phishing attacks that require confidential information of individuals like passwords, private keys, etc, Phishing campaigns require a user to grant the bad guys access to spend users’ tokens. In this case, users are made to believe that the link or address they are granting access to is authorized and legitimate.

Once the hackers make their way into Namecheap’s SendGrid, they send fake emails to clients disguising themselves as either DHL or Metamask.

Afterward, the malicious email claiming to be from DHL will appear as a delivery fee invoice, while the MetaMask phishing email notifies the clients that a Know-Your-Customer (KYC) verification was needed to avoid suspension of clients’ wallets.

Once the user approves permission by clicking the link in the email, they will be redirected to a page where they will provide a personal private key or a secret recovery phrase to the hackers.

This simply means the hacker will be able to spend tokens, thereby placing the assets at great risk of being drained totally. However, Namecheap noted that its own systems were not affected as users’ assets, accounts, and personal information is secure.

Responding to the attack, MetaMask, a software cryptocurrency wallet in a Tweet warned users against clicking on any link claiming to be from MetaMask or Namecheap as it will never request for customer’s KYC details.