when

Crypto scammers are up to no good again, and their latest weapon appears to be malicious links to a webpage that looks and feels almost exactly like the video conferencing platform Zoom, which prompts users to install malware when clicked.
On July 22, non-fungible token collector and cybersecurity engineer “NFT_Dreww” <a href="https://x.com/nft_dreww/status/1815356247010320757" target="_blank" rel="noopener nofollow">alerted</a> X users to a new “extremely sophisticated” crypto scam involving fake links for Zoom.
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2024-07/10e7aa25-89a3-4528-9c44-52bdd17ebadc.jpg" alt="Fake Zoom malware steals crypto while it’s ‘stuck’ loading, user warns">
 <figcaption style="text-align: center;">
 Malicious Zoom link. Source: NFT_Dreww
 </figcaption>
</figure>
Drew said the scammers have already stolen $300,000 worth of crypto from the method. 
<h2 id="how-the-scam-works">How the scam works</h2>
Like many social engineering scams,&nbsp;Drew explained that&nbsp;<a href="https://cointelegraph.com/news/trader-loses-68-million-address-poisoning-scam">scammers</a>&nbsp;typically target non-fungible token (NFT holders or crypto whales, asking if they would be interested in licensing their&nbsp;<a href="https://cointelegraph.com/explained/how-to-protect-intellectual-property-in-web3">intellectual property</a>, inviting them to Twitter Spaces, or asking them to join a team for a new project. 
The scammers will insist on using Zoom and hurry the target to join a meeting in progress using a hard-to-notice malicious link. 
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2024-07/50dc0e56-723d-4755-b02c-dd5a683a0dac.jpg" alt="Fake Zoom malware steals crypto while it’s ‘stuck’ loading, user warns">
 <figcaption style="text-align: center;">
 Comparing the malicious domain with the genuine one. Source: NFT_Dreww
 </figcaption>
</figure>
<blockquote>
 “It's extremely easy to fall for this... I doubt 80% of people verify each character in a link that's sent, especially a Zoom link.”
</blockquote>
Once the link is clicked, the user will be met with a “stuck” page showing an infinite loading screen. The page will then prompt the user to download and install ZoomInstallerFull.exe, which is actually malware. 
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2024-07/d53354c7-732b-4b9a-89e5-b3f99ebbd5c6.jpg" alt="Fake Zoom malware steals crypto while it’s ‘stuck’ loading, user warns">
 <figcaption style="text-align: center;">
 Screenshot of malware being installed. Source: any.run
 </figcaption>
</figure>
Once installed, the page will redirect back to the official Zoom platform, making the user believe it worked, but by then, the malware has already infiltrated the target computer and <a href="https://cointelegraph.com/news/phishing-scams-layer-2-base-up-1900-percent-since-january">stolen the data and loot</a>, explained Drew.
According to technologist “Cipher0091,” whom Drew also credits for his X thread, when the <a href="https://cointelegraph.com/news/what-is-crypto-malware-and-how-to-detect-it">malware</a> is first executed, it adds itself to the Windows Defender exclusion list to prevent antivirus systems from blocking it. 
“Then it begins executing and extracting all your information while the software is distracting you with the “spinning loading page” and going through the process of accepting T&amp;Cs, etc,” explained Drew. 
He added that the scammers will keep changing domain names to prevent them from being flagged, and this was their fifth domain so far for this scam. 
Related: <a href="https://cointelegraph.com/news/scammers-steal-crypto-posing-as-coinbase-scam-call-attacks">Coinbase-posing scammers steal $1.7M from a user amid a string of attacks</a>
Social engineering crypto scams are not new, but they do keep evolving. Several crypto community members have <a href="https://x.com/ljxie/status/1815561298572169536" target="_blank" rel="noopener nofollow">reported</a> receiving malicious emails this week from scammers <a href="https://cointelegraph.com/explained/impersonation-scams-in-crypto-explained">impersonating</a> other crypto influencers and executives.
The email contains a malicious attachment that will likely install crypto-stealing malware if executed. 
Related: <a href="https://cointelegraph.com/news/lazarus-group-laundered-200m-crypto-since-2020">Lazarus Group laundered over $200M in hacked crypto since 2020</a>

Fake Zoom malware steals crypto while it’s ‘stuck’ loading, user warns

Table of Contents

Cointelegraph

Other articles published on Jul 23, 2024

Crypto: Official Launch of Ethereum ETFs on July 23!

XRP Whales Bag 74M Coins As Ripple Vs SEC Case Nears Conclusion

Coinbase Custody Services Will Access 8 New Spot Ethereum ETFs

Republic’s Premier Note Dividend Pool Surpasses $1 Million Milestone

US Exchanges List ETH ETFs After Long Anticipation

Amazon AWS Node Runners Adds Sui Support

Join our free newsletter for daily crypto updates!