Medium

Swap

Security

TRON

Read

<div class="cryptonews">
 <p class="is-style-lead">The fake Skype application is being heavily distributed on the Chinese internet, the SlowMist Security Team has learned.</p>
 <p>As many international marketplaces are inaccessible within China due to local regulations, bad actors are actively exploiting this gap, flooding the market with phishing applications targeting <a rel="noopener noreferrer nofollow" title="crypto" href="https://thebittimes.com/tag/crypto.html">crypto</a> <a rel="noopener noreferrer nofollow" title="investors" href="https://thebittimes.com/tag/investors.html">investors</a>.</p>
 <p>According to a blockchain security firm SlowMist, a group of Chinese scammers has recently started distributing a fake version of Skype — version 8.87.0.403 — for Android devices among multiple local marketplaces, such as 51pgzs, siyuetian, and others. They lure victims to believe they downloaded a legit version of the video chat application.</p>
 <figure class="wp-block-image size-full"><picture decoding="async" class="wp-image-14214955">
   <source type="image/webp" srcset="https://cdn.thebittimes.com/images/2023/11/13/ec9528274dbd8eb1086328e16d8efb6b.webp.webp">
   <img decoding="async" width="1080" height="652" src="https://cdn.thebittimes.com/images/2023/11/13/ec9528274dbd8eb1086328e16d8efb6b.webp" alt="Chinese hackers target crypto investors with fake Skype - 1"> 
  </picture>
  <figcaption class="wp-element-caption">
   Fake Skype application for Android on a Chinese marketplace | Source: Medium
  </figcaption>
 </figure>
 <p>Once the malicious application is installed, it obtains images from various directories on the Android phone and monitors in real-time for any new images. All the images stored on the victim’s device are then uploaded to the phishing gang’s backend interface.</p>
 <div class="cn-block-related-link">
  <svg class="cn-block-related-link__icon icon" aria-hidden="true"><use xlink:href="#"></use>
  </svg> <span class="cn-block-related-link__prefix"> You might also like: </span> North Korea targets blockchain engineers with new macOS malware
 </div>
 <p>Analysts at SlowMist also learned that the gang behind the fake Skype application also targeted users in 2022 with its scam version of Binance, pointing out that both malicious applications have similar backend domain “bn-download3[dot]com.”</p>
 <blockquote class="wp-block-quote">
  <p>“Further <a rel="noopener noreferrer nofollow" title="Category Analysis" href="https://thebittimes.com/analysis.html">Analysis</a> revealed that ‘bn-download[number]’ is a series of fake domains used by this phishing gang specifically for Binance phishing, indicating that this gang is a repeat offender targeting Web3 specifically.”</p> <cite>SlowMist</cite>
 </blockquote>
 <p>In addition to images, the malicious application sends data to bad actors’ backend, such as device information, user ID, and phone number. To make things worse, the fake Skype even monitors incoming and outgoing messages to see if they include TRON or Ethereum-type address format strings to replace them with addresses pre-made by the scammers automatically.</p>
 <figure class="wp-block-image size-full"><picture decoding="async" class="wp-image-14214961">
   <source type="image/webp" srcset="https://cdn.thebittimes.com/images/2023/11/13/80e9ac4b02f8ba03ef2238b7c0045728.webp.webp">
   <img decoding="async" width="1080" height="565" src="https://cdn.thebittimes.com/images/2023/11/13/80e9ac4b02f8ba03ef2238b7c0045728.webp" alt="Chinese hackers target crypto investors with fake Skype - 2"> 
  </picture>
  <figcaption class="wp-element-caption">
   A USDT wallet on TRON belonging to a malicious Chinese gang | Source: Medium
  </figcaption>
 </figure>
 <p>SlowMist found out that the TRON chain address, which belongs to the scammers, had received nearly $193,000 in Tether (USDT) with 110 transactions, noting that funds are still coming in as the most recent transaction was on Nov 8, 2023. In general, most of the stolen funds were laundered through BitKeep’s Swap service, with the transaction fees covered by a user registered on the OKX <a rel="noopener noreferrer nofollow" title="crypto" href="https://thebittimes.com/tag/crypto.html">crypto</a> exchange, SlowMist emphasized.</p>
 <div class="cn-block-related-link">
  <svg class="cn-block-related-link__icon icon" aria-hidden="true"><use xlink:href="#"></use>
  </svg> <span class="cn-block-related-link__prefix"> Read more: </span> Blackberry identifies malware that affects crypto community
 </div> <span class="google-news-banner__label">Follow Us on Google News</span>
</div>
<p>Source: <a rel="noopener noreferrer nofollow" target="_blank" href="https://thebittimes.com/chinese-hackers-target-crypto-investors-with-fake-skype-tbt70032.html">https://thebittimes.com/chinese-hackers-target-crypto-investors-with-fake-skype-tbt70032.html</a></p>

Chinese hackers target crypto investors with fake Skype

TheBitTimes

Other articles published on Nov 13, 2023

Aave V2 Operational, Will Bulls Break The 15-Month Resistance At $110?

Evaluating performance of crypto traders: key metrics to watch

CBOE Digital to Launch the First Crypto Platform for Spot and Margin Trading

How to Prepare for the Crypto Bull Market

Hong Kong is Preparing to Offer Investment Immigration Opportunity with Bitcoin!

Top French Blockchain Dev Firms: Building a Diverse Ecosystem

Join our free newsletter for daily crypto updates!