Beware of SMS messages claiming to protect your Pi Coin account—phishing sites are stealing wallets
Pi Coin smishing campaign sends SMS messages with phishing links to steal 24-word cryptocurrency wallet recovery seed phrases from users worldwide. Threat actors send SMS messages impersonating Pi Network account protection services. The messages link to multi-language phishing pages that harvest 24-word wallet recovery seed phrases, enabling full wallet takeover. Campaign observed across US, Europe, China, India, and Vietnam since 2025.
Detection / Hunteropenrouter
Immediate Actions
- Alert users about Pi Coin account protection smishing campaign
- Block known phishing domains at DNS resolver and web proxy
- Monitor DNS for newly registered domains containing Pi Network keywords
Key Takeaways
- Phishing pages mimic Pi Network layout and support multiple languages for global reach
- Attackers harvest 24-word recovery seed phrases granting full wallet access
- Campaign active since 2025 across US, Europe, China, India, Vietnam
- Smishing pattern resembles previous Telegram and Microsoft account compromise campaigns
- No technical IOCs published; available via AhnLab TIP subscription
Attack Chain
- Initial Access: SMS message impersonating Pi Network account protection sent to target
- Execution: User clicks embedded link redirecting to phishing page
- Credential Harvesting: Phishing page mimics Pi Network and prompts 24-word seed phrase entry
- Impact: Attacker uses seed phrase to take full control of victim's wallet
Affected Systems
- Pi Network users
- Cryptocurrency wallet users
- Mobile device users receiving SMS
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Attack is user-facing social engineering via SMS and web; no endpoint malware involved. |
| Network Visibility | Medium | Phishing domains and DNS queries may be visible via web proxy and DNS logs. |
| Detection Difficulty | Hard | Relies on user interaction with lookalike domains; no malware payload to detect. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| DNS queries to newly registered domains containing Pi Network brand keywords indicate phishing infrastructure (T1566.002) | DNS resolution logs, WHOIS data | Initial Access | Medium — legitimate Pi Network domains may match keyword filters |
| Users submitting form data containing 24-word seed phrase patterns to external web pages indicates credential harvesting (T1606) | Web proxy DLP logs, browser telemetry | Credential Harvesting | Low — seed phrase entry on external sites is inherently abnormal |
Required Log Sources
- DNS query logs
- Web proxy logs
- SMS gateway logs
- URL filtering logs
Key Behavioral Indicators
- SMS messages containing URLs with Pi Network-related keywords
- Newly registered domains containing pinetwork or picoin terms
- Web form submissions containing 24-word recovery phrase patterns
- User navigation to sites mimicking Pi Network branding
Control Gaps
- SMS gateways may not inspect embedded URLs for phishing
- DNS filtering may miss newly registered lookalike domains
- DLP may not detect seed phrase text patterns in web form submissions
False Positive Assessment
Low — phishing pages mimic legitimate Pi Network branding but seed phrase web entry is inherently suspicious.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Deploy SMS URL rewriting and link sandboxing for corporate mobile fleets
- Enable DNS filtering for newly registered domains
- Block lookalike domains containing pinetwork or picoin keywords
User Protection
- Instruct users to never enter wallet seed phrases on web pages
- Direct users to verify account status via official Pi app only
- Deploy mobile browser anti-phishing extensions
Security Awareness
- Train users to recognize smishing messages impersonating cryptocurrency services
- Advise users that legitimate services never request seed phrases via web forms
MITRE ATT&CK Mapping
Resource Development
Initial Access
Execution
Credential Access
Plain-Language Summary
Criminals are sending text messages that pretend to protect your Pi Coin account. The messages contain links to fake websites that look like the real Pi Network service. These fake sites ask you to enter your 24-word wallet recovery phrase, which gives the criminals full access to your cryptocurrency wallet. Never enter your recovery phrase on a website you reached through a text message link.