Ethereum

TRON

Security

Cybersecurity firm SlowMist <a href="https://slowmist.medium.com/fake-skype-app-phishing-analysis-35c1dc8bc515" target="_blank" rel="noopener nofollow">reported</a> on a new vector targeting crypto and Web3 users. This scam, which led to the theft of funds from an unsuspecting victim who downloaded the app from the internet, highlights the growing sophistication of cybercriminals targeting not just wallets and exchanges but also widely used social media apps. 
<h2 id="slowmist-uncovers-sophisticated-phishing-operation-using-fake-skype-app">SlowMist Uncovers Sophisticated Phishing Operation Using Fake Skype App</h2> 
According to the report, the attack was launched mostly against users in China. In the region, restrictions against conventional App stores forced users to download unofficial software versions, creating bigger vulnerabilities. 
Skype, WhatsApp, Telegram, and other significant applications are often the subject of these attacks. On this occasion, the security firm examined an attack using a fake version of Skype, which affected an individual who lost $200,000. 
Upon examination, the fake Skype app’s signature information raised immediate red flags, being overly “simplistic” and labeled merely as “CN,” as seen in the image below. 
<img loading="lazy" decoding="async" class="size-medium wp-image-264356" src="https://bitcoinist.com/wp-content/uploads/2023/11/Crypto-Skype-Fake-App-Image-1.png?w=640&amp;resize=640%2C198" alt="Crypto Skype Fake App Image 1" width="640" height="198" srcset="https://bitcoinist.com/wp-content/uploads/2023/11/Crypto-Skype-Fake-App-Image-1.png?w=828 828w, https://bitcoinist.com/wp-content/uploads/2023/11/Crypto-Skype-Fake-App-Image-1.png?w=640&amp;resize=640%2C198 640w, https://bitcoinist.com/wp-content/uploads/2023/11/Crypto-Skype-Fake-App-Image-1.png?w=768 768w, https://bitcoinist.com/wp-content/uploads/2023/11/Crypto-Skype-Fake-App-Image-1.png?w=750 750w" sizes="(max-width: 640px) 100vw, 640px" data-recalc-dims="1"> 
This, coupled with the certificate’s recent effective date of September 11, 2023, suggested a recent creation, likely by a Chinese phishing group. Using an outdated Skype version, the app was found across multiple internet sources, aligning with the victim’s account. 
<h2 id="a-deeper-look-into-the-phishing-app-attack">A Deeper Look Into The Phishing App Attack</h2> 
The SlowMist team’s analysis went deeper, uncovering that the app had been fortified using Bangcle, a tactic common in fake apps to hinder analysis. Decompiling the APK revealed alterations to the okhttp3 network framework, enabling the app to hijack various data from the user’s device. 
This modified okhttp3 was designed to upload images and monitor for new ones in real time, sending them to a phishing backend. 
The phishing backend ‘bn-download3.com’ had previously impersonated the Binance exchange before mimicking a Skype backend. This domain was part of a series used by the phishing gang, indicating their repeated offenses in the Web3 world. 
The app also sought user permissions under the guise of social media functionality and then began uploading personal data, including images, device information, and phone numbers. In a more sinister turn, the app monitored for and replaced cryptocurrency addresses in messages with malicious ones controlled by the attackers. 
The SlowMist team successfully blacklisted the malicious addresses and, through their MistTrack analysis, discovered significant amounts of USDT transactions linked to these addresses, with funds being transferred out through various services. 
The stolen funds were sent to the following addresses on the TRON and Ethereum blockchain: TJhqKzGQ3LzT9ih53JoyAvMnnH5EThWLQB and TEGtKLavujdMrYxQWAsowXqxUHMdurUhRP (TRON). On the second blockchain: 0xF90acFBe580F58f912F557B444bA1bf77053fc03, 0x03d65A25Db71C228c4BD202C4d6DbF06f772323A. 
This case mirrors a previous fake Binance app scam, reported in late 2022, revealing a pattern of sophisticated phishing operations. Users are urged to download apps only from official channels and stay vigilant against such deceptions. 
The SlowMist Security Team emphasizes the importance of enhanced security awareness in the blockchain space. As of this writing, Ethereum (ETH) trades at $2,060. 
<img loading="lazy" decoding="async" class="wp-image-264359 size-large" src="https://bitcoinist.com/wp-content/uploads/2023/11/Ethereum-Crypto-Skype-ETHUSDT-ETH-Price.png?resize=980%2C467" alt="Ethereum Crypto Skype ETHUSDT ETH Price" width="980" height="467" srcset="https://bitcoinist.com/wp-content/uploads/2023/11/Ethereum-Crypto-Skype-ETHUSDT-ETH-Price.png?w=1759 1759w, https://bitcoinist.com/wp-content/uploads/2023/11/Ethereum-Crypto-Skype-ETHUSDT-ETH-Price.png?w=640 640w, https://bitcoinist.com/wp-content/uploads/2023/11/Ethereum-Crypto-Skype-ETHUSDT-ETH-Price.png?w=768 768w, https://bitcoinist.com/wp-content/uploads/2023/11/Ethereum-Crypto-Skype-ETHUSDT-ETH-Price.png?w=980 980w, https://bitcoinist.com/wp-content/uploads/2023/11/Ethereum-Crypto-Skype-ETHUSDT-ETH-Price.png?w=1536 1536w, https://bitcoinist.com/wp-content/uploads/2023/11/Ethereum-Crypto-Skype-ETHUSDT-ETH-Price.png?w=750 750w, https://bitcoinist.com/wp-content/uploads/2023/11/Ethereum-Crypto-Skype-ETHUSDT-ETH-Price.png?w=1140 1140w" sizes="(max-width: 980px) 100vw, 980px" data-recalc-dims="1"> 
Cover image from Unsplash, chart from Tradingview

Exposing A Crypto Heist: Fake Skype App Linked To Loss Of 200,000 USDT

Table of Contents

Bitcoinist

Other articles published on Nov 13, 2023

Chinese hackers use fake Skype app to target crypto users in new phishing scam

THORChain Flips Curve Finance on Weekly Trade Volume on DEXs

Shekel Mobility secures $7m funding to aid Africa’s growing car market

MEME Coin pumps 44% today: Is MEME coin GOOD to Buy?

Bithumb Korea to IPO in 2025 in Bid to Enhance Trust and Regain Market Supremacy

Hilton Australasia Innovates with TikTok Recruitment Strategy

Join our free newsletter for daily crypto updates!