Your NFTs and crypto wallet can be drained with this email

Josh Chavez took to Twitter to share a sad story about a dangerous scam he was the target of. Fraudsters used an old technique with an infected file in documents attached to an email message.

NFT artist gets scammed by evildoers from Instagram

On January 19, 2022, Josh M. Chavez, an American digital artist, announced that scammers have stolen all tokens and NFTs from his MetaMask on-chain cryptocurrency wallet.

Today my MetaMask was drained and NFTs were sold, all within minutes.

I never thought this would happen to me as I live on the internet and can spot scams a mile away but today I forgot to double check one small detail: 🧵 pic.twitter.com/HwkIW14mTT

— ⊕ Josh Chavez (@tropical ratchet) January 19, 2023

The artist has revealed that he was contacted by a potential customer via direct messages on Instagram. Although the “customer” account is being followed en masse by bots, Chavez has chosen to ignore this fact.

The Stranger has ordered the cover for their upcoming song. Chavez asked them to send details of the request, including release information, budget, concept, references, and so on. All these details were sent to Chavez by email.

The fraudster, using the name “Oscar Davies”, sent the documents; one of them was labeled as .pdf but actually had the filename extension .exe. EXE files are designed to run computer programs when opened.

Once the file was opened, it was immediately associated with Chrome, the browser where MetaMask wallets are integrated. In the blink of an eye, he drained the tokens from MetaMask and sold all the NFTs at auctions for a small fraction of their real price.

Deceptive scams in the NFT segment are on fire

Chavez points out that the entire social engineering procedure was masterfully crafted: despite his experience, he hasn’t noticed any warning signs:

I live on the internet and can spot scams a mile away, but today I forgot to double-check one small detail (…) I wasn’t just in a hurry, it was a routine thing – something I complacently did many times in the end with customers

As covered by U.Today previously, prominent players in the NFT market were targeted by sophisticated scam campaigns in Q4 2022 and Q1 2023. In November, the attackers hacked Greg Solano’s social media , the founder of BAYC, and started spreading phishing links.

Amid euphoria over the FIFA World Cup in Qatar, scammers managed to get past Twitter security checks and promoted a fake Binance x Cristiano Ronaldo NFT airdrop.