Quote from: Lucius on July 14, 2025, 02:32:10 PM

Quote from: The Cryptovator on July 14, 2025, 08:21:45 AM

~snip~
Even for firmware upgrades or software updates, I don't trust the apps notifications. I just go to their official website by typing the address and update my software. Because on Electrum we have seen how scammers were able to send notifications on the apps that force the download of fake software or malware. So always need to verify the official sources. Because it's related to the funds, and we need to be very careful.

Isn't it easier (safer) to save the original link to your favorites and then use it every time you need it? Typing an address is error-prone and just one wrong letter can lead you to a phishing address.

Sending messages via e-mail and exploiting a vulnerability in an official app is something completely different. What hackers did with Electrum 7 years ago, if I'm not mistaken, was truly brilliant (for them, of course).

Yes, it was indeed a very well-executed social engineering tactic, but unfortunately, the lightning bolt of knowledge struck the wrong house, the criminal.

I don't remember exactly how this attack happened, as it was so long ago (if I'm not mistaken, it involved malicious servers exploiting a vulnerability that allowed notification pop-ups to be displayed to users, tricking them into thinking it was an Electrum wallet procedure).

Likewise, we must always be alert, identifying any non-standard procedures with these wallets (e.g., Electrum displays a message in the footer informing that there's a new version of Electrum, but the update is never performed through the app; instead, there's a link to the official website). Likewise, we must be careful with our hardware wallets, downloading, for example, the Trezor Suite from the official website (and preferably saving it in the browser), verifying that the software behaves as in previous versions, and always carefully reviewing the information displayed on the screen of these devices.

Everyone is already tired of knowing, never, under any circumstances, provide the seed phrase (or passphrase), even if the hardware wallet software is requesting it (because in this case it's a trojan pretending to be the official software).