Retool Attributes Breach That Affected Crypto Users with Google’s Authenticator

Read full article at CryptoPotato.

Retool, a prominent software development company, has recently revealed that 27 of its cloud customers fell prey to a targeted SMS-based phishing attack.

The breach has raised concerns about the security of cloud synchronization features, particularly Google Authenticator’s cloud sync.

Retool Falls Prey to Targeted SMS Phishing Attack

The Aug. 27 attack began with a deceptive SMS phishing campaign directed at Retool’s employees. The malicious individuals pretended to be IT team members and urged recipients to click on a seemingly legitimate link to address a payroll-related problem. One employee fell for this trick and ended up on a fake login page with a multi-factor authentication form where their login credentials were stolen.

Once they had acquired the employee’s login details, they went a step further by contacting the person directly. Using advanced deepfake technology, they convincingly imitated the voice of a member of the IT team and tricked the employee into disclosing the multi-factor authentication code.

The situation took a turn due to the employee’s use of Google Authenticator’s cloud synchronization feature, allowing the attackers to gain access to internal administrative systems. Subsequently, they gained control of the accounts belonging to 27 customers within the cryptocurrency industry.

One of the affected clients, Fortress Trust, suffered a substantial loss, with approximately $15 million worth of cryptocurrency stolen as a result of the breach.

US Government Issues Warning Over Deepfake Threat

The use of deepfake technology in this attack has prompted concern within the U.S. government. A recent advisory warned about the potential misuse of audio, video, and text deepfakes for malicious purposes, such as business email compromise (BEC) attacks and cryptocurrency scams.

Although the identity of the hackers remains undisclosed, the tactics employed resemble those of a financially motivated threat actor known as Scattered Spider, or UNC3944, known for its sophisticated phishing techniques.

Mandiant, a cybersecurity firm, shared insights into the attackers’ methods, stating they might have used access to victim environments to enhance their phishing campaigns. This involved creating new phishing domains with internal system names, as observed in some cases.

Kodesh stressed the importance of this incident, emphasizing the risk of syncing one-time codes to the cloud. This compromised the “something the user has” factor in multi-factor authentication. He suggested that users consider using FIDO2-compliant hardware security keys or passkeys to strengthen security against phishing attacks.

The post Retool Attributes Breach That Affected Crypto Users with Google’s Authenticator appeared first on CryptoPotato.

This article is strictly for informational purposes only. It is not a direct offer or solicitation of an offer to buy or sell, or a recommendation or endorsement of any products, services, or companies. does not provide investment, tax, legal, business or accounting advice. Neither the company nor the author is responsible, directly or indirectly, for any loss or damage caused or alleged to be caused by, or in connection with, the use of or reliance on any content, goods, services or opinions mentioned in this article.

#Bitcoin #Crypto #Cryptocurrency

Related articles

Matt Gaetz Leaks Text From McCarthy Claiming He Wants To Fund Endless War

Read full article at Timcast IRL. Sign Up For Exclusive Episodes At Merch – Hosts: Tim […]

Learn More

Binance Recovers $450,000 Stolen in Curve Phishing Attack

Read full article at Crypto Briefing Blog.The assets Binance recovered represent about 83% of the entire sum stolen […]

Learn More

GitHub unbans Tornado Cash repositories following OFAC guidance

Read full article at News. Crypto mixer Tornado Cash has returned to the software development platform GitHub […]

Learn More