Pudgy Penguins Launched A New Game. Crypto Scammers Made A Fake Version

A pretend web site impersonating Pudgy Penguins’ newly launched Pudgy World browser recreation is trying to steal cryptocurrency pockets passwords, cybersecurity agency Malwarebytes Labs warned Tuesday.

In a report, Malwarebytes stated the phishing operation, pudgypengu-gamegifts[.]reside, makes use of extremely convincing replicas of crypto pockets interfaces to deceive customers. “Some options are tied to digital collectibles and in-game gadgets saved in cryptocurrency wallets. Meaning the official recreation generally asks gamers to attach a crypto pockets to confirm possession of things or unlock further options,” Stefan Dasic, senior malware analysis engineer and report writer stated.

“The phishing web site abuses that step: When a customer selects their pockets on this pretend web site, it reveals what seems to be that pockets’s personal unlock display. To the person, it appears to be like for all of the world like the true crypto pockets software program they already belief.”

Phishing stays one of the crucial widespread types of cybercrime. Based on the FBI’s Web Crime Grievance Heart (IC3), phishing and spoofing scams accounted for 193,407 complaints in 2024, with reported losses exceeding $70 million. It isn’t identified if anybody has fallen sufferer to this explicit web site.

What’s Pudgy World?

The warning comes per week after the launch of Pudgy World, a free-to-play browser recreation tied to the Pudgy Penguins $NFT model. The sport, which went reside on March 10, permits gamers to discover a digital world, customise penguin avatars and full quests, with some options requiring customers to attach cryptocurrency wallets.

Pudgy Penguins has grown quickly since being acquired by CEO Luca Netz in 2022, increasing from an $NFT assortment right into a broader client model with retail merchandise, a cell recreation and now a browser-based recreation. The gathering has a ground value of 4.25 $ETH ($9,500), in line with CoinGecko, far under 88.3% its December 2024 excessive of 36.33 $ETH.

Dasic stated the timing of the marketing campaign seems deliberate, coinciding with the sport’s launch and the inflow of recent customers unfamiliar with crypto pockets safety practices.

“The vary of wallets focused can also be important. The marketing campaign leaves nearly no pockets blind spot,” he stated. “Whether or not the sufferer holds Ethereum, Solana, or multi-chain belongings, there’s a convincing forgery ready for them.”

“Constructing 11 wallet-specific UI forgeries is just not a trivial enterprise,” Dasic added, noting that it suggests both a “well-resourced menace actor” or the reuse of a industrial phishing package constructed for this class of assault.

Such techniques are widespread in crypto-related scams, the place attackers register domains that carefully resemble respectable ones or manipulate search adverts to look genuine. For instance, fraudsters could ship out official-looking emails utilizing a website with “.qov” as an alternative of “.gov” within the hopes folks gained’t discover the slight distinction.

Pudgy Penguins has beforehand been focused by scammers utilizing pretend websites. In December 2024, blockchain safety agency Rip-off Sniffer warned that attackers had been utilizing malicious Google adverts to impersonate Pudgy Penguins platforms and trick customers into connecting their wallets.

Customers are suggested to entry official websites solely by means of trusted bookmarks, keep away from clicking hyperlinks from social media or direct messages, and keep in mind that respectable pockets password prompts don’t seem inside webpage content material. Malwarebytes additionally really helpful altering pockets passwords instantly if credentials had been entered on a suspicious web site and contemplating transferring funds to a brand new pockets if compromise is suspected.

Pudgy Penguins has been approached for remark.