A phishing campaign targeting Uniswap users is once again turning search engines into high-risk points for cryptocurrency theft. Foreign media reports indicate that attackers are using fake Google ads to deliver fake pages, tricking users into connecting their wallets and signing malicious authorizations, resulting in the theft of over $400,000.
Attacks using search ads to drive traffic
These attacks do not rely on vulnerabilities in the protocol itself, but rather exploit users' habit of searching for official website entry points in search engines. Attackers purchase keyword ads related to Uniswap to make the counterfeit website appear at the top of search results, and then use page design to mimic the official interface to lower users' guard.
Once users enter the fake page, they are often prompted to connect their wallets, confirm transactions, or update authorization. On the surface, these steps are similar to normal usage, but the signature content actually hands over control of the tokens to the attacker or directly triggers a transfer.
It has already caused losses of over $400,000.
The report mentions that this phishing campaign has netted attackers over $400,000. The losses didn't come from a single large theft, but rather from the continuous harvesting of multiple victim addresses, suggesting that the related ads and phishing pages may have been operating for some time.
Based on past cases, phishing attacks are common in decentralized exchanges, airdrop applications, and wallet connections. Attackers typically do not directly attack on-chain protocols, but instead prioritize attacking user access points because this method is lower in cost and easier to bypass the detection capabilities of ordinary users.
Front-end access security has once again become a focus.
This incident once again illustrates that the risks faced by DeFi users come not only from smart contracts, but also from search engines, social media platforms, and front-end pages. Even if the protocol itself is functioning correctly, assets can still be transferred during the authorization process if a user enters an incorrect link.
For frequently used protocols like Uniswap, higher brand recognition makes them easier targets for imitation. Search ads, fake domains, and highly similar page layouts have become recurring techniques used by attackers.
- Affected users: Uniswap users who access the fake page through a search.
- Attack methods: Google Ads redirection, fake official website pages, malicious signatures
- Known losses: Attackers profited over $400,000.
