MetaMask, the ConsenSys-owned crypto wallet provider, has sent out a warning to the community regarding Apple iCloud phishing attacks.
It has been reported that the security issue for iPhone, Mac, and iPad users is related to default device settings which see a user’s seed phrase or “password-encrypted MetaMask vault” stored on the iCloud if the user has enabled automatic backups for their application data.
MetaMask noted that users run the risk of losing their funds if their Apple password “isn’t strong enough” and an attacker is able to phish their account credentials.
It added:
“If you have enabled iCloud backup for app data, this will include your password-encrypted MetaMask vault. If your password isn’t strong enough, and someone phishes your iCloud credentials, this can mean stolen funds.”
However, the warning from MetaMask came in response to reports from an NFT collector who goes by “revive_dom” on Twitter, who stated on Friday that their entire wallet contains $650,000 worth of digital assets and nonfungible tokens (NFTs) was wiped via this specific security issue.
The report said that DAPE NFT project founder “Serpent” — who also helped gain the attention of MetaMask via posting sharing the story with their 277,000 followers — gave a rundown of what happened to the victim. They noted that the victim received multiple text messages asking to reset his Apple ID password along with a supposed call from Apple which was ultimately a spoofed caller ID. As they were reportedly unsuspecting of the caller, “revive_dom” handed over a six-digit verification code to prove that they were the owner of the Apple account.
Likewise, the scammers subsequently hung up and accessed his MetaMask account via data stored on iCloud.
While most of the community response was supportive, others were quick to emphasize the importance of using cold storage and doing a lot of due diligence when storing assets in a hot wallet.
Source: Cointelegraph