As cryptocurrencies have gone mainstream, more individuals have had the opportunity to participate in the financial system and build personal wealth. At the same time, scammers have increasingly targeted users with complex scams to rob them of their investments. Recently, scammers have increasingly turned to a scheme known as “pig butchering,” which involves a scammer reaching out and slowly manipulating an unsuspecting individual into transferring them money. 

### What is Pig Butchering? 

Pig butchering is not a ruse confined to the crypto industry.  It occurs when a scammer takes a long-term approach to its target, building trust over a sustained period, often with small talk, feigning a romantic interest or promises of large returns on investments. But the scammer’s aim is always the same: Defraud targets of their assets, whether it is fiat currency or crypto assets. 

Pig butchering is also not confined to any particular demographic or population - anyone can be targeted and fall victim to these scams. The scam is known as "pig butchering" because it backs the idea of fattening up a pig before slaughter. Except in this case, the scammers will leverage social media, dating apps, or text messages, manipulating their targets by appealing to their emotions and eventually causing them to let their guard down. 

After the scammer establishes trust with their target, they will introduce the idea of making some kind of risk-free investment, even offering doctored financial information to assuage any concerns. They will entice the target to share personal banking information and ultimately convince them to transfer large sums of fiat or cryptocurrency. The scammers may even send a small amount of funds to the target to show that their investment is profitable to draw out the scam for as long as possible. Once they have defrauded their target out of their investments, they often simply disappear.   

### How To Spot Pig Butchering Schemes 

__Beware of contact from random people:__ If you receive a phone call, text message, email, or direct message from someone you don’t recognize, put your guard up immediately. Pig butchering scammers will often send a text or random message, then attempt to strike up a conversation over an inane topic to pique your interest. Once you’ve let your guard down, they will strike with a request for personal financial information to make an investment. 

__Beware of the get-rich quick pitch:__ Investing comes with risks, whether it’s investing in the stock market or digital assets. If you ever are in a conversation with someone who offers an investment opportunity without risk, it is most likely too good to be true. Every investment opportunity has upside and downside risks. Beware of any individual who will tell you differently–and simply walk away if they put any pressure on you making a decision quickly.  

__Never Give Away Personal Info or Financial Info:__ This might sound obvious, but when in doubt, avoid giving away your personal or financial information to someone you have met online. This includes your social security number, bank account number, credit or debit card details, or your crypto wallet address. Simply avoiding these pitfalls will ensure you won’t be vulnerable to pig butchering schemes.

Onward and Upward!<br> 
Team Gemini


Learning More About Pig Butchering Scams and How To Avoid Them

- Collaboration between our Customer Support (CS), Trust and Safety (T&S), Threat Detection and Response (TDR), and Application Security (AppSec) teams regularly leads to the identification and takedown of phishing sites.
- We believe that our varied and extensive countermeasures help keep our users protected, and we continuously monitor and adapt to new threats, ensuring our customers' assets remain secure.
- Gemini is committed to helping maintain the integrity, trustworthiness, and resilience of crypto networks, ensuring the foundations remain strong for the future of decentralized innovation.

![Blog Inline 03](//images.ctfassets.net/jg6lo9a2ukvr/6NjikZ3DzdLHZdqBx8G1oG/87208c48dc03f7b455a92a1085b1de34/Blog_Inline_03.png)

At Gemini, ensuring the safety of our customers' assets and personal information is paramount. Since day one, we’ve operated with a security-first mindset, and we continually update our processes to stay ahead of threat actors.

In this blog post, we discuss the methods we used and actions we took against a specific phishing campaign to secure our customers’ crypto and account information, and display how we shared the information we gathered for the benefit of the wider crypto industry.

Collaboration between our Customer Support (CS), Trust and Safety (T&S), Threat Detection and Response (TDR), and Application Security (AppSec) teams regularly leads to the identification and takedown of phishing sites. To better understand attackers’ methods, we conduct investigations from a secure and isolated browsing environment to analyze phishing sites, uncovering valuable insights into their tactics. 

By understanding the broader landscape of ATO attempts, we are better equipped to analyze the specific incident we encountered. Our investigations not only focus on the immediate threat but also contribute to the security community’s knowledge of threat actors, helping to identify patterns, improve control measures, and ultimately enhance our overall security posture.

### Understanding Phishing Campaigns and Account Takeovers

Account takeovers (ATOs) occur when a threat actor gains unauthorized access to a customer’s account through various means, including exploiting vulnerabilities in authentication systems, leveraging misconfigurations, or social engineering. The Cyber Security and Information Security Agency (CISA) describes phishing [as a form of social engineering](https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks). Phishing attacks aim to scam users out of personal and confidential information (such as your password or phone number) by abusing trust. 

In most instances, phishing attacks take the form of misleading emails, text messages, or social media posts which can trick people into inadvertently responding with private information, transferring funds to the attacker’s cryptocurrency wallet, or clicking a malicious link which compromises passwords. Attackers often do this by directing a customer to a web page that is designed to look like it is owned by a trusted brand or company (i.e. Gemini). While most phishing attacks now take place online, these attacks can also occur over the phone or via offline communication channels.

### The Phishing Campaign We’re Discussing Today

Today, we shed light on a specific phishing campaign in which threat actors sent Gemini customers emails and texts directing them to a fake Gemini-branded landing page. 

From the fake pages, unsuspecting users would be coerced to divulge their Gemini credentials, and the nefarious actors would then attempt to gain access to the real Gemini accounts, with the ultimate aim of stealing funds.

### Assessing the Tactics, Techniques, and Procedures (TTPs)

When our security team is made aware of an ongoing phishing campaign we gather all relevant information about the threat vector, take every action possible to mitigate potential damage, and get started on identifying and targeting the threat.

Analyzing phishing campaigns is central to protecting users from existing and future threats. To do this, we actively identify the malicious actors' tactics, techniques, and procedures (TTPs), as well as potential security control improvements. Below, we dive into some of the TTPs we identified during our process.

__The Use of Multiple Hosting Providers to Impede Triage Efforts__

While analyzing the sites the malicious emails and texts were directing users to, we determined that there was a landing phishing site and then a secondary harvesting phishing site hosted on different providers. 

The landing sites had assets hosted on the CloudFlare network that linked to the harvesting phishing sites hosted on a separate network, notably azurewebsites.net. Those assets being on CloudFlare meant that tools like urlscan.io weren’t able to crawl the site to the depth needed to identify the harvesting phishing sites. 
![Blog phishing Diagram](//images.ctfassets.net/jg6lo9a2ukvr/1naVVtq5xDBkjFOo1Npbi3/e1f8673fa5d04549c2d9a020e183024d/Blog_phishing_Diagram.png)

The diagram above is a simplified view of the malicious actors redirection. Victims that click on the assets hosted on Cloudflare are redirected from the landing phishing site, primarily hosted on webflow.io, to the harvesting phishing site hosted on azurewebsites.net.

We faced the same issue during our reconnaissance process, where we weren’t able to load the harvesting site in BurpSuite, an application security testing software. We were able to bypass those constraints by configuring FireFox to use BurpSite as a proxy to analyze the traffic more ergonomically. BurpSuite Proxy allowed us to retain all the HTTP that was generated while the browser interacted with the phishing sites and also provided us with the ability to search, highlight, and comment on HTTP requests. 

__Multiple Hosting Providers__

The majority of the phishing sites we reviewed were a subdomain of the following sites. The subdomains were meant to look like they belonged to Gemini Trust Company LLC. For brevity we only include one example of each site.
![Blog phishing Multiple Hosting Providers](//images.ctfassets.net/jg6lo9a2ukvr/W4zgzLkmGgjFAqMON5qHA/bee4a39a331fc4aa63e9e3e8aa65085f/Blog_phishing_Multiple_Hosting_Providers.png)
### Credential Harvesting Tactics

__Use of Email to Transfer Harvested Credentials__

While analyzing the phishing sites hosted on azurewebsites[.]net we discovered a misconfiguration that disclosed the attacker programmatically sending the unsuspecting user’s credentials and phone number from a GMail address to other GMail addresses. Those email addresses are available below:
![Blog phishing Email](//images.ctfassets.net/jg6lo9a2ukvr/EBBH1jqMjjiwvcLanV8Cp/6552e9f548c46181b03dbe5354863dff/Blog_phishing_Email.png)

__Malicious Customer Support Chats__

After the user enters a phone number, the site returns an error message and opens a chat window hosted by LiveChat, at which point the attacker requests further information from the user. During our recon we saw the chat window appear and a support agent frantically requested that we provide them with our credentials. They claimed that they needed our credentials as they were alerted that we weren’t able to log in to our account and would like to unblock us as soon as possible. We reported the following license_ids to LiveChat, which swiftly addressed the issue. 
![Blog phishing Chat Ids](//images.ctfassets.net/jg6lo9a2ukvr/4ZQQQw7BDcsfgnqNwbyNSP/8fe0497782bb8eba1bc6efb2e987dd4a/Blog_phishing_Chat_Ids.png)
### Steps We Took to Secure the Ecosystem

At Gemini, we believe that active participation is a necessary component to securing the crypto cybersecurity ecosystem. By actively engaging in cybersecurity efforts, whether you're a developer, user, or enthusiast, you contribute to the collective defense against these threats. Gemini is committed to helping maintain the integrity, trustworthiness, and resilience of crypto networks, ensuring the foundations remain for the future of decentralized innovation. 

__ZeroFox — Shutting Down Phishing Websites__

In partnership with ZeroFox, a cloud-based cybersecurity company, we shut down over 200 phishing sites while investigating this campaign. This collaboration not only helped take down these sites but also exposed email addresses linked to the attackers, leading to further investigations. 

We collaborated with ZeroFox to share this intelligence and improve the detection of malicious sites. Additionally, we reached out to providers whose infrastructure was exploited for illicit activities. 

### Conclusion

We believe that our varied and extensive countermeasures help keep our users protected, and acknowledge that the battle against threats on the Internet is ongoing. We continuously monitor and adapt to new threats, ensuring our customers' assets remain secure.

Gemini is dedicated to protecting its customers and the cryptocurrency community at large, and implementing new tools to support this goal. Earlier this year we introduced passkeys, which add an extra layer of security to Gemini accounts. [Check out this blog](https://www.gemini.com/blog/passkeys-add-security-feature-to-gemini-account) to get a better understanding of how passkeys work and how they could have protected users who visited phishing sites.

Our proactive measures, collaborative efforts, and continuous vigilance against ATO attempts demonstrate our unwavering commitment to providing a secure trading environment across the crypto industry. As the crypto landscape evolves, so do our security practices, ensuring that Gemini remains a trusted platform. Your security is our priority.

Onward and Upward!

The Gemini Security Team

Gemini Security Team

ARTICLES BY Gemini Security Team

Learning More About Pig Butchering Scams and How To Avoid Them

How to Recognize and Dismantle a Phishing Campaign

A simple, secure way to buy and sell cryptocurrency