Medium

Swap

Security

TRON

Read

The fake Skype application is being heavily distributed on the Chinese internet, the SlowMist Security Team has learned. 
As many international marketplaces are inaccessible within China due to local regulations, bad actors are actively exploiting this gap, flooding the market with phishing applications targeting crypto investors. 
According to a blockchain security firm SlowMist, a group of Chinese scammers <a href="https://slowmist.medium.com/fake-skype-app-phishing-analysis-35c1dc8bc515" target="_blank" rel="noreferrer noopener">has recently started</a> distributing a fake version of Skype — version 8.87.0.403 — for Android devices among multiple local marketplaces, such as 51pgzs, siyuetian, and others. They lure victims to believe they downloaded a legit version of the video chat application. 
<figure class="wp-block-image size-full">
 <img decoding="async" loading="lazy" width="1080" height="652" src="https://crypto.news/app/uploads/2023/11/0_Xq0mkqe5sJCRaG4g.png" alt="Chinese hackers target crypto investors with fake Skype - 26" class="wp-image-14214955">
 <figcaption class="wp-element-caption">
 Fake Skype application for Android on a Chinese marketplace | Source: Medium
 </figcaption>
</figure> 
Once the malicious application is installed, it obtains images from various directories on the Android phone and monitors in real-time for any new images. All the images stored on the victim’s device are then uploaded to the phishing gang’s backend interface. 
 You might also like: <a href="https://crypto.news/north-korea-targets-blockchain-engineers-with-new-macos-malware/"> North Korea targets blockchain engineers with new macOS malware </a> 
Analysts at SlowMist also learned that the gang behind the fake Skype application also targeted users in 2022 with its scam version of <a href="https://crypto-news.webpkgcache.com/doc/-/s/crypto.news/tag/binance/" data-type="link" data-id="https://crypto-news.webpkgcache.com/doc/-/s/crypto.news/tag/binance/">Binance</a>, pointing out that both malicious applications have similar backend domain “bn-download3[dot]com.” 
<blockquote class="wp-block-quote"> 
 “Further analysis revealed that ‘bn-download[number]’ is a series of fake domains used by this phishing gang specifically for Binance phishing, indicating that this gang is a repeat offender targeting Web3 specifically.” <cite>SlowMist</cite>
</blockquote> 
In addition to images, the malicious application sends data to bad actors’ backend, such as device information, user ID, and phone number. To make things worse, the fake Skype even monitors incoming and outgoing messages to see if they include <a href="https://crypto.news/price/tron/" data-type="link" data-id="https://crypto.news/price/tron/">TRON</a> or <a href="https://crypto.news/price/ethereum/" data-type="link" data-id="https://crypto.news/price/ethereum/">Ethereum</a>-type address format strings to replace them with addresses pre-made by the scammers automatically. 
<figure class="wp-block-image size-full">
 <img decoding="async" loading="lazy" width="1080" height="565" src="https://crypto.news/app/uploads/2023/11/joisdpjfisdjf.png" alt="Chinese hackers target crypto investors with fake Skype - 27" class="wp-image-14214961">
 <figcaption class="wp-element-caption">
 A USDT wallet on TRON belonging to a malicious Chinese gang | Source: Medium
 </figcaption>
</figure> 
SlowMist found out that the TRON chain address, which belongs to the scammers, had received nearly $193,000 in Tether (USDT) with 110 transactions, noting that funds are still coming in as the most recent transaction was on Nov 8, 2023. In general, most of the stolen funds were laundered through BitKeep’s Swap service, with the transaction fees covered by a user registered on the OKX crypto exchange, SlowMist emphasized. 
 Read more: <a href="https://crypto.news/blackberry-identifies-malware-that-affects-crypto-community/"> Blackberry identifies malware that affects crypto community </a>

Chinese hackers target crypto investors with fake Skype

crypto.news

Other articles published on Nov 13, 2023

Polytrade TRADE Token Surge After Announcing Partnership With DWF Labs

Best Answers to Frequently Asked Questions About Cloud Mining

Bitcoin miners hit annual high with over $44m in revenue

Bitcoin Supply Squeeze: Glassnode Report Reveals Historic Lows Ahead of Fourth Bitcoin Halving

Where to Buy ICON Coin?

ARMK Stock Price: Investors are Missing Out on 706% EPS

Join our free newsletter for daily crypto updates!