Phishing for a Group Show - by Israel Lund

A=N=T=E=N=N=A B=U=I=L=D=E=R

SubscribeSign in

Phishing for a Group Show<br>A deep dive into the NFT phishing operation making its rounds in the art world

Israel Lund<br>Jun 19, 2026

Share

I exist in two socially different worlds. One is the fine art world in New York City, having been a gallery represented, working artist for over 10 years, and the other is tech / cybersecurity, where I’ve worked the past 5+ years as a full-stack engineer with a heavy interest in security. I have my art friends and my tech friends, and surprisingly the two hardly ever overlap. So I took notice when a few artists I follow on Instagram posted stories about them being impersonated through email. This impersonator’s scam was inviting artists to make NFTs for a Web3 group exhibition at the impersonated artist’s representing gallery. Having an interest in security and being overly curious as to how cybercrimes work, a phishing scam in the art world is just my type of thing. It felt like a joining of my two realms of interest, and since you don’t often hear about scams happening in this world too often, I decided to look into it further. The following is by no means all of the ways you one can go about investigating if an email or website is a scam or not, but simply some places to start looking if your spidey senses are tingling. With AI making it easier for scammers to create convincing phishing campaigns, it pays to have some skepticism and know where to start looking.<br>As mentioned, I first encountered this scam through Instagram stories shared by artists I follow. My first step in looking into it was to get the full email sent by the scammers and get a bigger picture of what was going on. I reached out to two artists affected and they happily forwarded me the what they received. Both emails were exactly the same, except the galleries representing the artists where this supposed show would happen were changed. So this was definitely a coordinated effort to impersonate and defraud as many artists as possible using the same template. A cursory Google search of the phishing email script returned social media posts from artists warning about these fake emails on multiple different platforms. All told the artists I found being impersonated were, Lucy Bull, Danica Lundy, Alfred Liu, Stefan Bruggermann, Ida Ekblad, Robert Longo, Celeste Rapone, Julie Curtiss, Ed Atkins, and curator/museum director Klaus Biesenbach. A relatively short list, but I’m sure there are plenty more that didn’t post about it.<br>Thanks for reading A=N=T=E=N=N=A B=U=I=L=D=E=R! Subscribe for free to receive new posts and support my work.

Subscribe

From the emails that were forwarded to me I was able to see the fake email addresses the phishers were using. The artist’s names were being imitated with what is called homoglyph spoofing (or homoglyph attack). For those new to this term, this means subtly adding in or replacing one or two characters in an email address to make it almost visually imperceptible. For example, they might replace an “m” with “rn” in the email address, and if the type is small enough or the victim only looks at the address briefly, the misspelling could be overlooked. rnarcelduchamp@gmail.com. Using this technique allows the scammers to make legitimate, objectively real Gmail accounts which can trick you into believing it’s from someone it isn’t, as well as allowing the emails to bypass inbox spam filters.<br>The next part of the scam is a little more sophisticated in its inception. It involves a convention that’s prevalent in the art world, but may not be widely known. The scammer posed as a successful artist, inviting lesser-known artists to contribute to a group exhibition they were curating at their blue-chip art gallery. Everything in the art world is social, and most opportunities arise from knowing someone or being in the right place at the right time. (The art world is also notoriously opaque; private sales, back-channel dealings, and unspoken codes of discretion are the norm, making it an industry where insider knowledge and personal relationships carry enormous weight.) These kinds of opportunities presented by artists can be mutually beneficial to both the artists asking and the artists receiving the invite. This art world convention allows younger or less established artists to participate in an exhibition at a gallery they may not normally get an opportunity to show their artwork in, and on the other end it gives more established artists a connection with a younger generation of artists, which can be a big contributor to their market and career longevity. This is a small example of the benefits of this convention, but overall it’s community building and a socially important aspect within art scenes. With all of that in mind, the scammer started out strong by trying to exploit this with what I think is a pretty good phishing lure: preying on upcoming, emerging artists in search of...