TRON

<div class="sg-post-des">
 Crypto security firm SlowMist has discovered 100 wallet addresses linked to a phishing scam that drained hundreds of thousands of dollars from unsuspecting crypto users.
</div>
<div class="cointelegraph">
 A new phishing scam has emerged in China that uses a fake Skype video app to target crypto users
 As per a report by crypto security analytic firm SlowMist, the Chinese hackers behind the phishing scam used China’s ban on international applications as the basis of their scam, as several mainland users often search for these banned applications via third-party platforms.
 Social media applications such as Telegram, WhatsApp, and Skype are some of the most common applications searched for by mainland users, so scammers often use this vulnerability to target them with fake, cloned applications containing malware developed to attack crypto wallets.
 <figure><img src="https://cdn.thebittimes.com/images/2023/11/13/de473b9c3f16f3554644319ee11bd9f3.webp">
 <figcaption style="text-align: center;">Baidu search results for Skype. Source: Baidu
 </figcaption>
 </figure>
 In its <a rel="noopener noreferrer nofollow" title="Category Analysis" href="https://thebittimes.com/analysis.html">Analysis</a>, the SlowMist team found that the recently created fake Skype application bore version number 8.87.0.403, while the latest version of Skype is actually 8.107.0.215. The team also discovered that the <a rel="noopener noreferrer nofollow" title="phishing" href="https://thebittimes.com/tag/phishing.html">phishing</a> back-end domain ‘bn-download3.com’ impersonated the Binance exchange on Nov. 23, 2022, and later changed it to mimic a Skype backend domain on May 23, 2023. The fake Skype app was first reported by a user who lost 'a significant amount of money' to the same scam.
 The fake app's signature revealed that it had been tampered with to insert malware, and after decompiling the app the security team discovered that it modified a commonly used Android network framework called okhttp3 to target crypto users. The default okhttp3 framework handles Android traffic requests, but the modified okhttp3 obtains images from various directories on the phone and monitors for any new images in real-time.
 The malicious okhttp3 requests <a rel="noopener noreferrer nofollow" title="users" href="https://thebittimes.com/tag/users.html">users</a> to give access to internal files and images, and as most social media applications ask for these permissions anyway they often don’t suspect any wrongdoing. Thus, the fake Skype immediately begins uploading images, device information, user ID, phone number, and other information to the back end.
 Once the fake app has access, it continuously looks for images and messages with TRX and ETH-like address format strings. If such addresses are detected, they are automatically replaced with malicious addresses pre-set by the phishing gang.
 <figure><img src="https://cdn.thebittimes.com/images/2023/11/13/f4aca9a348e96653e4f5cdc84797cb42.webp">
 <figcaption style="text-align: center;">Fake Skype app backend. Source: Slowmist
 </figcaption>
 </figure>
 During SlowMist testing, it was found that the wallet address replacement had stopped, and the phishing interface’s back end was shut down and no longer returned malicious addresses.
 Related: 5 sneaky tricks <a rel="noopener noreferrer nofollow" title="crypto" href="https://thebittimes.com/tag/crypto.html">crypto</a> <a rel="noopener noreferrer nofollow" title="phishing" href="https://thebittimes.com/tag/phishing.html">phishing</a> scammers used last year
 The team also discovered that a TRON chain address (TJhqKzGQ3LzT9ih53JoyAvMnnH5EThWLQB) received approximately 192,856 USDT until Nov. 8 with a total of 110 transactions made to the address. At the same time, another ETH chain address (0xF90acFBe580F58f912F557B444bA1bf77053fc03) received approximately 7,800 USDT in 10 deposit transactions.
 In all, more than 100 malicious addresses linked to the scam were uncovered and blacklisted.
 Magazine: Thailand’s $1B <a rel="noopener noreferrer nofollow" title="crypto" href="https://thebittimes.com/tag/crypto.html">crypto</a> sacrifice, Mt. Gox final deadline, Tencent NFT app nixed
 <template data-name="subscription_form" data-type="law_decoded"></template>
</div>
Source: <a rel="noopener noreferrer nofollow" target="_blank" href="https://thebittimes.com/chinese-hackers-use-fake-skype-app-to-target-crypto-users-in-new-phishing-scam-tbt70062.html">https://thebittimes.com/chinese-hackers-use-fake-skype-app-to-target-crypto-users-in-new-phishing-scam-tbt70062.html</a>

Chinese hackers use fake Skype app to target crypto users in new phishing scam

TheBitTimes

Other articles published on Nov 13, 2023

VeChain Joins Industrial Blockchain Task Force with Major Industry Players

Bitcoin Mining Rewards Hit an Annual Daily High of $44 Million

US Financial Services Committee to Probe Illicit Activities in Cryptocurrency Ecosystem

Why is the Crypto Market Down Today?

Argentina's inflation rises to 143%

Vyvo Smart Chain Selected for Web Summit’s Startup Growth Program

Join our free newsletter for daily crypto updates!