A brand new phishing marketing campaign is exploiting the growing curiosity of safety group members in direction of Flipper Zero to steal their private info and cryptocurrency.

Flipper Zero is a conveyable multi-functional cybersecurity device for pen-testers and hacking fanatics. The device permits researchers to tinker with a variety of {hardware} by supporting RFID emulation, digital entry key cloning, radio communications, NFC, infrared, Bluetooth, and extra.

The builders launched the system after a massively profitable 2020 Kickstarter campaign, which surpassed the funding purpose of $60,000 by 81 instances, after receiving $4,882,784 in pledges.

Since then, safety researchers’ demonstrations of the endlessly amusing and considerably scary capabilities of Flipper Zero on social media have helped generate a lot hype across the system, elevating the curiosity of aspiring hackers and researchers.

Nonetheless, up to now yr, the product was hampered by manufacturing points inflicting provide shortages that made it not possible to fulfill the still-growing demand. 

In September 2022, revenue holdbacks by digital payments platform PayPal put the mission in danger, endangering its manufacturing by holding $1.3 million destined for ordering new manufacturing batches.

Focusing on cybersecurity researchers

Risk actors are actually benefiting from the immense curiosity in Flipper Zero and its lack of availability by creating faux outlets pretending to promote it. 

These phishing campaigns had been found by safety analyst Dominic Alvieri, who noticed three faux Twitter accounts and two faux Flipper Zero shops.

At first look, one of many faux Twitter accounts seems to have the identical deal with because the official Flipper Zero account. Nonetheless, in actuality, it makes use of a capital “I” within the identify, which appears similar to an “l” on Twitter.

This faux Twitter account is actively responding to folks about availability and different account’s tweets to make it look respectable.

On the time of scripting this, one of many faux outlets stays on-line, pretending to promote Flipper Zero, the Wi-Fi module, and the case on the identical value because the precise store.

The purpose is to take consumers to the phishing checkout web page, the place they’re requested to enter their e-mail addresses, full names, and transport addresses.

The victims are then given a option to pay utilizing Ethereum or Bitcoin cryptocurrency and are instructed that their order will probably be processed inside quarter-hour after submission

The listed pockets addresses haven’t acquired any funds, so both the actual store hasn’t managed to trick any safety researchers or used new wallets after every transaction.

The menace actors have since switched to utilizing plisio.web invoices to just accept crypto funds, which now embrace Litecoin. Nonetheless, these invoices usually are not working, stating that the order has expired.

So long as the curiosity and shortages proceed, cybercriminals will continue to attempt to impersonate Flipper Zero by faux outlets to trick safety fanatics into giving up their private info and crypto.

On account of this, it’s critical to be looking out for these promotions and outlets claiming instant product availability and solely purchase from the official store.