{
  "timestamp": "2025-02-05T20:13:27.513779",
  "content": "Search Free Trial Get Demo Axie Infinity Player Wallets Targeted by Poisoned Google Ads Content July 27, 2021 The top NFT Ethereum-based game Axie infinity, is a Pokemon-like play-to-earn game that lets its users earn SLP Smooth Love Potion. This potion can be traded as a crypto currency and has recently reached its all-time high value of 0.40. Many people are trying to get into this hot crypto game, and with that comes the risk of getting targeted by threat actors. Here we encountered some google ads when trying to search for Ronin Wallet. Ronin is the digital wallet used in the game if you want start playing. Figure 1. Search results for Ronin Wallet. Figure 2. Top ad result points to hxxpaccount.roninwallet.us Once you click the link on the ad, it will redirect you to hxxpsroninwallet.netapp. The landing page looks exactly like the legitimate Ronin wallet browser extension page. Figure 3. Fake Ronin Wallet page. Figure 4. Legitimate Ronin Wallet Chrome extension page. Since the phishing page mimics the functionality of the legitimate ronin wallet, the process of creating and importing a wallet is just like the legitimate one. If a victim tries to create a new wallet, a wallet will be created on the legitimate website. We tried to create a wallet on the fake page and verify it on the legitimate site and it indeed created one. Figure 5. Fake Create a New Wallet page Creating a new wallet will require the account owner to transfer funds from their own cryptocurrency accounts, which means there is less of a chance for the threat actor to steal cryptocurrency immediately. Crypto currency wallets are locked using a seedsecret phrase, allowing wallet owners to import their wallets from other devices, such as a mobile phone, or another computer using either a mobile app version of the wallet or a browser extension. This feature, though very convenient, makes the wallet owners more vulnerable because importing an existing wallet may mean that the wallet already contains crypto currencies that the threat actors can steal. Understand what it takes to detect and respond to targeted phishing attacks on Office 365 in real-time. Read the Playbook Like the wallet creation page, the wallet import functionality was mimicked by the threat actor and looks exactly like the legitimate Ronin wallet page. Looking through the phishing page html source shows embedded JavaScript code that is not present in the legitimate extension page. Below is the screenshot of the comparison of the source codes Figure 6. Inspection view of the Legitimate Ronin Wallet extension page. Figure 7. Inspection view of the fake Ronin wallet seed import page. Below is an excerpt of the script used in the fake page for importing a ronin wallet, which redirects the victim to  once the ronin wallet seed phrase has been successfully entered. This tricks the user into believing that the form in use is from the legitimate Ronin developer. Figure 8. Embedded JavaScript code, which steals imported wallet seed phrase. Cyren detects these phishing pages as JSRonphish.A!Eldorado. Best Practice and Recommendations Since writing this blog, the phishing pages have already been suspended, but we highly advise players to only open links to the Ronin installation binaries from the official Axie Infinity site to avoid being a victim of threat actors that are abusing ad contents. Indicators of Compromise hxxpaccount.roninwallet.us hxxpwww.ronin-wallet.com Find out how to investigate targeted phishing incidents. Read the Playbook Try it for Free Instant Data Classification Cyren URL Category Chacker Prev How Phishers Abuse Hypertext Transfer Protocol Secure HTTPS Protocol 2021 Phishing  BEC Attacks Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443",
  "analysis_type": "user_guidance",
  "analysis": "### Security Advisory for Axie Infinity Players\n\nTo protect yourself from phishing attacks targeting Axie Infinity players via poisoned Google Ads, follow these practical security recommendations:\n\n1. **Verify the Source**\n   - **Official Channels Only:** Always access the Ronin Wallet through the official Axie Infinity website. Avoid clicking on Google Ads; instead, navigate directly to the official site.\n   - **URL Verification:** Carefully check URLs. Hover over links to examine the domain. While HTTPS indicates a secure connection, it doesn't guarantee safety. Cross-reference URLs with the official Ronin Wallet site.\n\n2. **Spotting Fake Websites**\n   - **Inspect the Site:** Fake sites mimic real ones closely. Look for slight differences in URLs or design. The official Ronin Wallet extension can be found in the Chrome Web Store.\n   - **Visual Cues:** Be cautious of typos or unusual domain names, such as \"roninwallet.us\" instead of the official \".io\" domain.\n\n3. **Seed Phrase Protection**\n   - **Keep It Private:** Never share your seed phrase online or enter it into untrusted sites. Treat it like a password and store it securely offline.\n   - **Secure Access:** Avoid using public computers or public Wi-Fi when accessing your wallet.\n\n4. **Use Official Channels for Software**\n   - **Trusted Downloads:** Download Ronin Wallet only from the Chrome Web Store or the official Axie Infinity site.\n   - **Caution with Ads:** Be wary of Google Ads. While Google filters malicious content, some phishing ads can evade detection temporarily.\n\n5. **Enable Two-Factor Authentication (2FA)**\n   - **Enhanced Security:** Enable 2FA on all related accounts to add an extra layer of protection against unauthorized access.\n\n6. **Keep Software Updated**\n   - **Regular Updates:** Ensure your Ronin Wallet and browser extensions are up-to-date with the latest security patches.\n\n7. **Monitor Your Accounts**\n   - **Regular Checks:** Periodically review your transaction history and account settings for any suspicious activity.\n   - **\u00e8s, Report Suspicious Activity:** If you suspect phishing or unauthorized access, contact Axie Infinity support immediately.\n\n8. **Spot Common Risks**\n   - **Educate Yourself:** Recognize phishing red flags: unsolicited ads, urgent messages, and unfamiliar sites. Report any phishing attempts to the appropriate channels.\n\n9. **Privacy Measures**\n   - **Limit Information Sharing:** Avoid sharing unnecessary personal or financial information online.\n   - **Use Privacy Tools:** Consider using VPNs or privacy-focused browsers to enhance your online security.\n\n10. **Seek Support When Needed**\n    - **Act Promptly:** If you believe your wallet has been compromised, change your passwords, revoke access to suspicious sessions, and contact support quickly.\n    - **Expert Advice:** If unsure about security measures, consult IT or cybersecurity professionals.\n\nBy following these guidelines, you can significantly reduce the risk of falling victim to phishing attacks and protect your digital assets effectively. Stay vigilant and proactive in safeguarding your information and crypto assets."
}