The article discusses the operations of the Wagmi Team, a group involved in NFT scams, which has made over .4 million since June 2023 by targeting victims on platforms like X and Discord. They use phishing tactics to compromise cryptocurrency wallets and deploy malicious applications disguised as web3 projects. Affected: X, Discord, Web3 community, cryptocurrency users
Keypoints :
- The Wagmi Team, previously known as the “Triple Culture” Team, has been active since early 2023.
- They advertise through platforms like Telegram and Nulled, specializing in NFT scams.
- They profit significantly from compromised wallets, using various phishing techniques.
- The group utilizes fake web3 projects and malicious applications to lure victims.
- Victims often inadvertently expose their cryptocurrency wallet addresses on social media.
- The team has developed tools to scrape potential victims from Twitter.
- Wagmi employs code signing certificates to evade detection by security systems.
- As of April 2025, the campaign has affected over 2,422 individuals.
MITRE Techniques :
- T1140: Introduction of new or updated malware. Procedure: Distribution of the Wagmi malware identified as Lumma and Rhadamanthys through various scam projects.
- T1071.001: Application Layer Protocol: Web Protocols. Procedure: Use of fake applications resembling legitimate services to solicit sensitive data from victims.
- T1486: Data Encrypted for Impact. Procedure: The stealing process involves encrypting/exfiltrating sensitive information, targeting cryptocurrency wallets.
- T1573: Exploitation for Client Execution. Procedure: Deployment of malicious payloads through deceptive installations masked as legitimate software.
Indicator of Compromise :
- [IP Address] 186.2.175.33
- [IP Address] 185.149.120.235
- [Domain] web-storechrome[.]com
- [Domain] currentsyb[.]com
- [Domain] pocketuniverses[.]org
Full Story: https://medium.com/@traclabs_/the-wagmi-manual-copy-paste-and-profit-2803a15bf540?source=rss-6a3005ed0ee2——2
Views: 20