Manta Network Co-Founder Warns of Sophisticated Phishing Attack

According to Cointelegraph, Manta Network co-founder Kenny Li recently revealed he was the target of a sophisticated phishing attack on Zoom. The attackers used live recordings of familiar individuals to deceive him into downloading malware. Li recounted the incident in an April 17 post on X, describing how the meeting appeared genuine, with the impersonated person's camera on. However, the absence of sound and a suspicious prompt to download a script raised alarms. Li stated, "I could see their legit faces. Everything looked very real. But I couldn’t hear them. It said my Zoom needs an update. But it asked me to download a script file. I immediately left." Li attempted to verify the impersonator's identity through a Telegram call, but they refused and subsequently erased all messages and blocked him. Li suspects the North Korean state-backed Lazarus Group orchestrated the attack. He managed to capture screenshots of his conversation with the attacker before the messages were deleted. During the exchange, Li suggested moving the call to Google Meet instead. Speaking with Cointelegraph, Li expressed his belief that the live shots used in the video call were sourced from past recordings of real team members, noting, "It didn’t seem AI-generated. The quality looked like what a typical webcam quality looks like." Li confirmed that the real person's accounts had been compromised by the Lazarus Group. He advised the crypto community to be cautious of unexpected download requests, emphasizing, "The biggest red flag will always be a downloadable. Whether it’s in the form of an update, an attachment, app, or anything else, if you need to download something in order to continue something with the person on the other side, don’t do it." Li acknowledged that such attacks could easily deceive crypto executives accustomed to frequent messages and sudden meeting requests, stating, "These are hacks that play to your emotional connection and potentially mental fatigue." Other members of the crypto community have reported similar experiences. A member of ContributionDAO shared, "They also asked me to download Zoom via their link, and said that it's only for their business. Even though I actually have Zoom on my computer, I couldn’t use it." They added that the attackers insisted on using a business version they had registered and refused to switch to Google Meet. Additionally, crypto researcher and X user "Meekdonald" mentioned a friend who fell victim to the same strategy that Li managed to avoid.