Zoom scam targets crypto users warns blockchain security firm SlowMist

CoinMarketCap2024-12-27

A phishing scam targeting crypto users that used fake Zoom meeting links as a method of malware distribution and stealing the target’s cryptocurrency assets has been uncovered by blockchain security ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2494175877?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2024-12-27 17:39","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2494175877","market":"us","top_or_hot":-1,"title":"Zoom scam targets crypto users warns blockchain security firm SlowMist","media":"CoinMarketCap","content":"<div>\n<p>A phishing scam targeting crypto users that used fake Zoom meeting links as a method of malware distribution and stealing the target’s cryptocurrency assets has been uncovered by blockchain security ...</p>\n\n<a href=\"https://coinmarketcap.com/community/articles/676e75cc72e56136df76ef95/\">Source Link</a>\n\n</div>\n","source":"coinmarketcap_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Zoom scam targets crypto users warns blockchain security firm SlowMist</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nZoom scam targets crypto users warns blockchain security firm SlowMist\n</h2>\n\n<h4 class=\"meta\">\n\n\n2024-12-27 17:39 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://coinmarketcap.com/community/articles/676e75cc72e56136df76ef95/><strong>CoinMarketCap</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>A phishing scam targeting crypto users that used fake Zoom meeting links as a method of malware distribution and stealing the target’s cryptocurrency assets has been uncovered by blockchain security ...</p>\n\n<a href=\"https://coinmarketcap.com/community/articles/676e75cc72e56136df76ef95/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"BK4528","symbol_name":"SaaS概念","start_time":0,"source_url":"https://coinmarketcap.com/community/articles/676e75cc72e56136df76ef95/","article_id":"2494175877","we_media_id":null,"thumbnails":[],"rights":null,"url":"https://stock-news.laohu8.com/highlight/detail?id=2494175877","pubTimestamp":1735292363,"columns":[],"sourceInfo":{"source_id":"coinmarketcap_highlight","name":"CoinMarketCap"},"weMediaInfo":null,"summary":"A phishing scam targeting crypto users that used fake Zoom meeting links as a method of malware distribution and stealing the target’s cryptocurrency assets has been uncovered by blockchain security firm SlowMist.Hackers have been using sophisticated techniques to steal private keys, wallet data, and other sensitive information, which has resulted in substantial financial loss for victims. The attackers used a phishing domain that mimicked a legitimate Zoom domain, “app[.] us4zoom[.] us.”, reported SlowMist on Dec. 27.The scam site illustrated Zoom’s interface and tricked users into hitting the “Launch Meeting” button. The button did not open the Zoom application; it started downloading a malicious installation package called “ZoomApp_v.3. 14. dmg.” After installation, this package ran a script called “ZoomApp.file” that asked users to put in their system password.SlowMist tracked the on-chain transfer of funds using an anti-money laundering tool, MistTrack. A profit of more than $1 mi","collect":0,"end_time":0,"defaultTopTitle":"coinmarketcap.com","property":[],"viewcount":null,"language":"en","relate_stocks":{"BK4528":"SaaS概念","BK4023":"应用软件","BK4532":"文艺复兴科技持仓","BK4554":"元宇宙及AR概念","BK4585":"ETF&股票定投概念","BK4525":"远程办公概念","CETH":"以太坊ETF-21Shares","BK4535":"淡马锡持仓","BK4588":"碎股","ETH":"迷你以太坊ETF-Grayscale","LU1861558580.USD":"日兴方舟颠覆性创新基金B","BK4551":"寇图资本持仓","QETH":"以太坊ETF-Invesco Galaxy","BK4505":"高瓴资本持仓","EZET":"以太坊ETF-Franklin","ZM":"Zoom","BK4548":"巴美列捷福持仓","BK4601":"加密货币现货ETF","FETH":"以太币ETF-Fidelity","LU1861559042.SGD":"日兴方舟颠覆性创新基金B SGD","ETHV":"以太坊ETF-VanEck"},"translate_title":"区块链安全公司SlowMist警告Zoom骗局针对加密货币用户","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"ZM":1,"ETH":1,"CETH":0.67,"QETH":0.67,"ETHV":0.67,"EZET":0.67,"FETH":0.67},"content_text":"A phishing scam targeting crypto users that used fake Zoom meeting links as a method of malware distribution and stealing the target’s cryptocurrency assets has been uncovered by blockchain security firm SlowMist.\nHackers have been using sophisticated techniques to steal private keys, wallet data, and other sensitive information, which has resulted in substantial financial loss for victims. The attackers used a phishing domain that mimicked a legitimate Zoom domain, “app[.] us4zoom[.] us.”, reported SlowMist on Dec. 27.\n\n\n  Source: SlowMist\n \n\nThe scam site illustrated Zoom’s interface and tricked users into hitting the “Launch Meeting” button. The button did not open the Zoom application; it started downloading a malicious installation package called “ZoomApp_v.3. 14. dmg.” After installation, this package ran a script called “ZoomApp.file” that asked users to put in their system password.\n\n\n\n⚠️Beware of phishing attacks disguised as Zoom meeting links!🎣 Hackers collect user data and decrypt it to steal sensitive info like mnemonic phrases and private keys. These attacks often combine social engineering and trojan techniques. Read our full analysis⬇️… pic.twitter.com/kDExVZNUbv— SlowMist (@SlowMist_Team) December 27, 2024\n\n\n\nUpon analyzing, SlowMist reported that the script called a hidden executable file to deploy named “.ZoomApp”. The app tried to access data like system information, browser cookies, KeyChain data, and cryptocurrency wallet credentials. The compressed data was then transmitted to a server under the hackers’ control, associated with the IP address 141.98.9.20, which has been labeled as malicious by multiple threat intelligence services.\nYou might also like:  Pig butchering crypto scams wiped out $3.6b this year: report \nThe malware, identified as a Trojan, was then subjected to static analysis and dynamic analysis, which showed that the software was also capable of executing scripts that decrypted the data, enumerated paths from the plugin ID, and extracted credentials stored on the victim’s device. This included stored passwords, cryptocurrency wallet details, and sensitive Telegram credentials, among other information. This allowed the attackers to obtain wallet mnemonic phrases and private keys, which facilitated the theft of large amounts of cryptocurrency. \nThe attackers’ back-end system, located in the Netherlands, tracked user interactions through the Telegram API, with signs that they employed Russian-language scripts. The phishing campaign went live on Nov. 14, 2024, and has already attempted to steal millions of dollars in crypto from various users.\nZoom scam on the Ethereum chain\nSlowMist tracked the on-chain transfer of funds using an anti-money laundering tool, MistTrack. A profit of more than $1 million was among the addresses of one of the hackers, where cryptocurrencies USD0++ and MORPHO were converted into 296 Ethereum (ETH). The stolen money was transferred to a series of platforms, including Binance, Gate.io, Bybit, and MEXC. Another address, which was used to make small ETH transfers to a total of 8,800 addresses, was included to pay for transaction fees.\nYou might also like:  Scammers bagged over $500k from 15+ X breaches \n\n\n  Blockchain analysis tracing Ethereum theft activity, illustrating the flow of stolen funds across wallets and platforms. Source: SlowMist\n \n\nThis stolen ETH was later aggregated into a different address, with transfers to several other sites, including exchanges such as FixedFloat and Binance, where it was converted into Tether (USDT) and other cryptocurrencies.\nRead more:  US hacker faces 20-year prison sentence over $37m crypto theft","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":null,"editions":null,"column":"","sentiment":"-1","news_tag":"","news_rank":0,"symbols":[],"gpt_button":1},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"deviceId":"web-server-community-laohu8-v3","version":"4.30.2","shortVersion":"4.30.2","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2494175877"}