Ethereum

2024

Read

A phishing scam targeting crypto users that used fake Zoom meeting links as a method of malware distribution and stealing the target’s cryptocurrency assets has been uncovered by blockchain security firm SlowMist. 
Hackers have been using sophisticated techniques to steal private keys, wallet data, and other sensitive information, which has resulted in substantial financial loss for victims. The attackers used a phishing domain that mimicked a legitimate Zoom domain, “app[.] us4zoom[.] us.”, <a href="https://slowmist.medium.com/seeing-is-deceiving-analysis-of-fake-zoom-meeting-phishing-attack-3b0138e13e49" target="_blank" rel="nofollow">reported</a> SlowMist on Dec. 27. 
<figure class="wp-block-image size-full">
 <img loading="lazy" decoding="async" width="720" height="321" src="https://crypto.news/app/uploads/2024/12/0_1vQbms1gJmncUtis-1.png" alt="Zoom scam targets crypto users warns blockchain security firm SlowMist - 21" class="wp-image-14322549">
 <figcaption class="wp-element-caption">
 Source: SlowMist
 </figcaption>
</figure> 
The scam site illustrated Zoom’s interface and tricked users into hitting the “Launch Meeting” button. The button did not open the <a rel="" href="https://crypto.news/giga-whale-loses-6-09m-after-clicking-a-malicious-zoom-link-report/">Zoom</a> application; it started downloading a malicious installation package called “ZoomApp_v.3. 14. dmg.” After installation, this package ran a script called “ZoomApp.file” that asked users to put in their system password. 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
 https://twitter.com/SlowMist_Team/status/1872526964789219563 
 </div>
</figure> 
Upon analyzing, SlowMist reported that the script called a hidden executable file to deploy named “.ZoomApp”. The app tried to access data like system information, browser cookies, KeyChain data, and cryptocurrency wallet credentials. The compressed data was then transmitted to a server under the hackers’ control, associated with the IP address 141.98.9.20, which has been labeled as malicious by multiple threat intelligence services. 
 You might also like: <a rel="" href="https://crypto.news/pig-butchering-scams-drain-3-6b-from-crypto-in-2024/"> Pig butchering crypto scams wiped out $3.6b this year: report </a> 
The malware, identified as a Trojan, was then subjected to static analysis and dynamic analysis, which showed that the software was also capable of executing scripts that decrypted the data, enumerated paths from the plugin ID, and extracted credentials stored on the victim’s device. This included stored passwords, cryptocurrency wallet details, and sensitive Telegram credentials, among other information. This allowed the attackers to obtain wallet mnemonic phrases and private keys, which facilitated the theft of large amounts of cryptocurrency.&nbsp; 
The attackers’ back-end system, located in the Netherlands, tracked user interactions through the <a rel="" href="https://crypto.news/hackers-target-telegram-and-whatsapp-users-with-trojanized-apps-to-steal-crypto/">Telegram</a> API, with signs that they employed Russian-language scripts. The phishing campaign went live on Nov. 14, 2024, and has already attempted to steal millions of dollars in crypto from various users. 
<h2 class="wp-block-heading" id="strong-zoom-scam-strong-strong-on-the-ethereum-chain-strong">Zoom scam on the Ethereum chain</h2> 
<a rel="" href="https://crypto.news/slowmist-reports-80-of-x-comments-related-to-phishing-software/">SlowMist</a> tracked the on-chain transfer of funds using an anti-money laundering tool, MistTrack. A profit of more than $1 million was among the addresses of one of the hackers, where cryptocurrencies USD0++ and MORPHO were converted into 296 Ethereum (<a rel="" href="https://crypto.news/price/ethereum/">ETH</a>). The stolen money was transferred to a series of platforms, including Binance, Gate.io, Bybit, and <a rel="" href="https://crypto.news/mexc-launches-the-meme-zone-unlock-early-opportunities-in-trending-meme-coins/">MEXC</a>. Another address, which was used to make small ETH transfers to a total of 8,800 addresses, was included to pay for transaction fees. 
 You might also like: <a rel="" href="https://crypto.news/scammers-bagged-over-500k-from-15-x-breaches/"> Scammers bagged over $500k from 15+ X breaches </a> 
<figure class="wp-block-image size-full">
 <img loading="lazy" decoding="async" width="720" height="1040" src="https://crypto.news/app/uploads/2024/12/phising-2.png" alt="A graphical representation of Ethereum theft events showing the flow of stolen ETH between various wallets and platforms, including Gate.io and MetaMask Swap Router. The central event, labeled &quot;Event: Theft,&quot; highlights the movement of ETH to different addresses with timestamps and transaction amounts detailed in arrows pointing to associated wallet addresses." class="wp-image-14322548">
 <figcaption class="wp-element-caption">
 Blockchain analysis tracing Ethereum theft activity, illustrating the flow of stolen funds across wallets and platforms. Source: SlowMist
 </figcaption>
</figure> 
This stolen ETH was later aggregated into a different address, with transfers to several other sites, including exchanges such as FixedFloat and Binance, where it was converted into Tether (<a rel="" href="https://crypto.news/price/tether/">USDT</a>) and other cryptocurrencies. 
 Read more: <a rel="" href="https://crypto.news/us-hacker-faces-20-year-prison-sentence-over-37m-crypto-theft/"> US hacker faces 20-year prison sentence over $37m crypto theft </a>

Zoom scam targets crypto users warns blockchain security firm SlowMist

Table of Contents

crypto.news

Other articles published on Dec 27, 2024

Explosive Crypto Growth: 5 Low-Cap Coins Set to Deliver 20,000% Gains by 2025

BTC Yet to Enter Bubble Phase, Says CryptoQuant CEO: Key Insights into the Bull Run

Ethereum Price Analysis: ETH Could Plummet to $3K After Losing These Support Levels

BTFD Coin’s Big 50% Bonus Shines Bright in the Top Meme Coin Presales to Buy Now as Notcoin Innov...

Bitcoin Whales Drive Surge in CoinJoin Transactions Amid Privacy Concerns

Will XRP ETFs Trigger a New Bull Run for Ripple in 2025?

Join our free newsletter for daily crypto updates!