FOLLOW US

Since Facebook announced its rebrand as Meta Inc — a Metaverse company, the virtual worlds space has been gaining a lot more attention than before. However, with the emergence of any technology, there come many risks.

The rapid inflow of cash and the non-regulatory nature of space have made the virtual worlds space a perfect crime scene for cyberattackers and scammers, according to threat researchers from Cisco’s Talos Intelligence Group.

"There's a huge potential for things like fraud and other traditional crimes, without there having the safety precautions that you have in other areas," Cisco Talos head of outreach Nicki Biasini told Insider. "And for the people affected by these scams, there's not a lot of recourse."

Talos logged several scams and many of these resemble tactics that date back to the infancy dates of the internet when social engineers future themselves as reliable sellers to trick people into spending and sharing their personal information. The new technology called Metaverse — which relies on cryptocurrency payments and digital assets built on a blockchain — is a new avenue for scammers to defraud people. 

For instance, one cyberattack method includes smart contracts — a piece of code on the blockchain that runs automatically once certain conditions are met. Smart contracts are set to guarantee that a buyer receives his digital assets like NFTs (non-fungible tokens) for example. However, scammers are installing malicious smart contracts that do the opposite of what they promote.

"We're seeing malicious smart contracts where they get you to approve a transaction, but you're actually executing a function that gives a third party access to all the tokens and cryptocurrency in your wallet," Talos technical lead Jaeson Schultz told Insider. "It's very easy for people to fall for these things because very few people are actually gonna take the time to actually read the smart contract, even if it is published."

One dangerous scam could defraud millions

Researchers at Talos have also witnessed hackers promoting themselves as trusted brands. For example, one user on the popular blockchain platform Ethereum has claimed domain names like wellsfargo.eth, foxnews.eth and that could trick people into thinking that they are on a legitimate website.

Since the blockchain is decentralized by nature with no administrator, this means that no one can take away the rightful owners of the domain.

"There's nothing that anyone can do to take these away. Once it's minted on the blockchain, it's essentially permanent. So this opens the door for a large amount of fraud," Schultz said.

To avoid falling victim, Schultz recommends people or companies doing business in the metaverse should avoid sharing any information about the assets they own, which could make them a target for scammers. 

"Because people are new to this space, it's creating opportunities for these attackers. So our best weapon right now is educating people about what to look out for," Schultz said.