Two decentralized finance projects are reportedly being targeted by a DNS spoofing attack. According to reports from Monday morning U.S. time, PancakeSwap and Cream Finance, two projects deployed on Binance Smart Chain, are phishing users into entering their private key on the website.
Cream Finance is inaccessible as of the time of writing, but PancakeSwap still loads correctly and showcases the phishing attempt. Upon trying to connect MetaMask, the page loads a fake window requesting the user to input their private key. This also happens on browsers like Safari, where MetaMask is unavailable. There are almost no occasions when a user should input their seed phrase into a browser app, especially not when interacting with DeFi.
