Unprivileged account compromise

NFT scammers hijack the IVSS Twitter account to promote the fake 'GoblinTown' collection

On July 5, 2022, Venezuela’s Independence Day, the official Twitter account of the Venezuelan Institute of Social Security (@ivssoficial, with approximately 284,000 followers) was compromised by attackers who posted a fake offer of free NFTs from the “GlobinTowm” collection (a knockoff of the real Goblin.Town collection). The links were designed to steal credentials, cryptocurrency funds, and user data. The IVSS warned its followers not to click on the links and migrated to a new account (@Somosivss). This was the second incident in less than a month following the same pattern, after the hijacking of the El Universal newspaper’s account.

Impact details

The IVSS official Twitter account was hacked and used to promote fake links to NFTs. Public documents indicate a risk to followers and warnings from IVSS, but no institutional data breach or financial losses have been confirmed.

Twitter accountsocial media presence

Classification & severity

Category
Intrusions
Subtype
Unprivileged account compromise
Confidence
High

Severity assessment

Medium
Functional impact
Minimal
Information impact
Integrity loss
Affected scope
Multiple users
Critical service
None
Public confidence
Limited
Recoverability
Regular

It has been confirmed that an official account was compromised and that followers were exposed to scams; however, there has been no confirmation of a data breach involving institutional data or a service disruption.

Integrity

Timeline

Compromise

The IVSS's official Twitter account (@ivssoficial) was hijacked and used to post a fake offer of free NFTs from the "GlobinTowm" collection.

Disclosure

The IVSS publicly warns that its account was hacked and asks followers not to click on fraudulent links; it creates the alternate account @Somosivss.

Evidence & sources

3 sources