{
  "timestamp": "2025-02-05T22:30:03.450145",
  "model": "deepseek/deepseek-r1-distill-llama-70b",
  "request": {
    "messages": [
      {
        "role": "system",
        "content": "You are a cybersecurity expert specializing in company websites and product documentation.\n        Analyze the content and classify it into the given categories.\n        Return only the applicable categories as a comma-separated list, nothing else."
      },
      {
        "role": "user",
        "content": "\n        Categories to choose from:\n        product_security_features, end_user_security, compliance_certifications, security_best_practices, data_protection, access_management, threat_prevention, incident_response, privacy_policy, technical_documentation\n        \n        Content to classify:\n        Search Free Trial Get Demo Phishing Targets Phantom Wallet December 13, 2021 Phantom is a browser based crypto wallet where you can store, send, receive, stake and exchange tokens in the Solana blockchain. With the skyrocketing prices of crypto currencies including SOL , a crypto wallet is one of the things we can use in order to get into the crypto currency action. Just recently there were several reports of wallets being wiped clean. An incident was reported by a user on twitter on how it happened. With just a copypasted message sent by a friend to a messenger group chat which includes a phishing link, he clicked it without verifying and it all went wrong from there. And now, they are trying to run pay per click campaigns to target more unsuspecting users. We previously reported fraudsters using online advertising in a phishing campaign that targeted Axie Infinity users through a fake Ronin wallet page. Malicious ads are not uncommon and large ad platforms like Google have processes to identify and remove fraudulent content. However, we were able to spot a fraudulent ad before it was quickly spotted and removed by Google. In this campaign, criminals trick users into creating a crypto wallet on a phishing site so the bad actors have access to the wallet. Once the victim transfers crypto into the wallet, the criminals steal the funds. Here is a step by step of the attack. Victims are lured to the phishing page with a fraudulent online ad. 2. The ad linked to a phishing page designed to mimic the real Phantom site. 3. The victims navigate the same user experience as they would when interacting with the real Phantom site. Below the user receives their Secret Recovery Phrase after choosing the Create New Wallet option 4. Then the user enters and confirms their wallet password. Note the user is still interacting with the phishing site. 5. Next the user receives instructions to open the malicious browser extension. 6. The criminals now have all the information from the victim they need to empty the crypto wallet. 7. And of course, to make the victim feel this process was legitimate, the Finish button redirected them to the actual Phantom site. Although the ads were immediately taken down, there were already several transactions done in the wallet that was created in the phishing page. This is mostly likely because the phishing page was used prior to it being published via the short-lived advertisement. Following the crypto currency transaction associated with the exposed wallet, some SOL ended up in this wallet which contains over 870,00 SOL.  It is the same wallet that was used when the Nobu Ninjas NFT minting website was hijacked via DNS cache poisoning. Details of how the hacking transpired are on Nobu Ninjas Twitter page . Best Practices and Recommendations As of this writing, the phishing page has been suspended. Users are advised to verify every link before clickingopening the site. Also, browser based crypto wallets need to be installed first as an extension in the browser, not after creating the wallet. In this scenario, the option to create a wallet comes first so it should trigger a red flag that it most probably a phishing page. IOCs httpsphhanton.app httpsphanton-account.website httpsphanton-account.space References    Find out how to investigate targeted phishing incidents. Read the Playbook Try it for Free Instant Data Classification Cyren URL Category Chacker Prev JavaScript Obfuscation in Phishing Sites 13 Types of Social Engineering Attacks Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443\n        "
      }
    ],
    "model": "deepseek/deepseek-r1-distill-llama-70b"
  },
  "response": {
    "content": "threat_prevention, end_user_security, data_protection, technical_documentation",
    "usage": {
      "prompt_tokens": 804,
      "completion_tokens": 238,
      "total_tokens": 1042
    },
    "model": "deepseek/deepseek-r1-distill-llama-70b"
  }
}