After the hijacking, hackers hosted the Mint Your Ferrari NFT scam on the luxury automaker’s official website.
On May 5th, 2022, reports emerged that Italian luxury automobile manufacturer Ferrari’s official website was hacked to promote a fake NFT collection. Interestingly, the company recently announced launching its official NFT collection, and hackers probably took advantage of this news. The fake NFT collection was presented as the official one to trap potential buyers.
Details of the NFT Scam
White hat hacker Sam Curry claims that attackers hijacked the subdomain ‘forms.ferrari.com’ of the company’s official website and hosted an NFT scam titled Mint Your Ferrari. The ethical hacker and bug bounty hunter also posted a screenshot of the hijacked website on Twitter.
Reportedly, the attackers lured visitors to purchase NFT tokens, claiming that it was Ferrari’s official 4458-horsepower NFT series that the company launched on the Ethereum network.
In December 2021, Screen Rant reported that the Ferrari collection would be launched in collaboration with a tech firm named Velas. Scammers marketed the fake NFT collection as akin to owning a Ferrari on the digital space and an instant gateway to the larger Ferrari metaverse.
More NFT Scam News
- Official website of Banksy hacked for fake NFT scam
- Phishing scam: NFTs Worth $1.7M Stolen from OpenSea Users
- Hot wallet hack: Hackers steal $18.7m from Animoca’s Lympo NTF platform
How Attackers Hijacked the Subdomain?
Further probe revealed that scammers exploited a flaw in the Adobe Experience Manager on the official website of Ferrari to hijack its subdomain and host the encrypted NFT scam content.
“After looking a bit deeper… it seems this was an Adobe Experience Manager exploit. You can still find the remnants of the unhacked site by dorking around a bit,” Curry explained.
Scammers seem to have failed to rake in a high amount from the victims. It is reported that the hacked site also prompted users to connect their MetaMask wallet to the site. Since Ferrari recently announced its plan to debut its official Metaverse, the scam seemed legit to unsuspecting users.
However, scammers made about $800, as noted by Twitter user Rebcesp who claimed the NFT scam’s Ethereum wallet received $884. The loss was minuscule since the fraud was quickly discovered, and the subdomain was shut down.
At the time of publishing this article, the compromised subdomain displayed the error code: HTTP 403 error code. It seems like just one person got scammed who sent 0.3ETH or roughly $800. The funds were transferred to Tornado Cash by the scammer.