Zoom Meeting Scam: Crypto Users Fall Prey to Potential Russian-linked Hackers

by

As a seasoned crypto investor with over a decade of experience navigating the digital asset landscape, I can attest that the ever-evolving tactics employed by cybercriminals never cease to amaze me. The recent phishing campaign centered around fake Zoom meeting links is yet another grim reminder of the constant vigilance required to safeguard one’s investments in this dynamic market.

Cybercriminals are once again exploiting trusted tools for malicious gains.

Currently, a phishing strategy focusing on fraudulent Zoom meeting links has led to significant cryptocurrency losses for the affected individuals.

Fake Zoom Invites Mask Malware

As a researcher, I’ve recently come across an intriguing findings from a blockchain security firm, SlowMist. They’ve uncovered a complex phishing scheme that aims to trick cryptocurrency users by distributing false Zoom meeting links. This deception, if successful, has been reported to lead to the pilferage of substantial digital assets, totaling millions.

The scenario included employing a fake website that looked like the real one. This deceitful site copied the legitimate Zoom layout to deceive unsuspecting individuals into downloading a harmful software package. When activated, this malware requested users to input their system passwords, granting access to sensitive data such as KeyChain information, login credentials for browsers, and details of cryptocurrency wallets.

After examining the code, SlowMist determined that it was a revised version of the osascript script. This script stole and encrypted users’ data, then sent it to a server controlled by hackers, which had been marked as harmful by threat intelligence systems.

It was discovered that the server’s IP location is in the Netherlands, and the use of logs displaying Russian language scripts points towards an association with Russian-speaking agents, potentially indicating Russian involvement in the attacks.

As a researcher, I’ve discovered that by employing the MistTrack tool from SlowMist, I was able to trace the hackers’ main wallet, which accumulated more than $1 million in stolen assets. This wealth was subsequently converted into approximately 296 ETH. Subsequent transactions led to a secondary address, now connected to activities on well-known crypto exchanges like Binance, Gate.io, and MEXC. A intricate web of smaller wallets and flagged addresses, including those labeled “Angel Drainer” and “Pink Drainer,” appears to have been instrumental in dispersing these funds.

“Such cyber-attacks frequently utilize a blend of social engineering tricks and Trojan tactics, rendering users susceptible to manipulation. To stay secure, SlowMist Security Team recommends that users always check meeting links before clicking on them, refrain from running unknown software or commands, install antivirus solutions, and ensure regular updates.

Phishing Scams Hit Alarming Highs

Recently, there’s been an increase in the number of crypto phishing scams. Not long ago, someone lost approximately $300,000 worth of cryptocurrency after clicking on a fake work meeting link sent via KakaoTalk. This malicious link installed harmful software that breached their Ethereum and Solana digital wallets, eventually transferring the compromised funds to a wallet linked with BingX.

In the month of November itself, a well-known blockchain security analyst known as Scam Sniffer revealed that over $9.4 million was stolen through phishing attacks. It appears that malicious signatures within the blockchain continue to pose significant risks, as scammers take advantage of false transaction permissions to empty digital wallets. In fact, some high-profile heists have surpassed $36 million in value.

Read More

2024-12-28 17:22