when

Security

Scammers are combining social engineering with phony Telegram verification bots that inject crypto-stealing malware into systems to raid crypto wallets, blockchain security firm Scam Sniffer said.&nbsp;
In a Dec. 10 X <a data-ct-non-breakable="null" href="https://x.com/realScamSniffer/status/1866465802020602074" rel="null" target="null" text="null" title="null">post</a>, the security firm said scammers are creating fake X accounts impersonating popular crypto influencers, then inviting users to Telegram groups with promises of investment insights.
Once in the Telegram group, users are asked to verify through “OfficiaISafeguardBot,” a fake verification bot that “creates artificial urgency” with short verification windows, the firm said.
<figure>
 <img alt="Scammers are using Telegram verification bots to inject crypto-stealing malware" src="https://s3.cointelegraph.com/uploads/2024-12/0193b393-1373-727c-bd3f-8618ff0df6c8" title="">
 <figcaption style="text-align: center;">
 Scammers impersonate popular crypto influencers on X and then invite users to malicious Telegram groups. Source: <a data-ct-non-breakable="null" href="https://x.com/realScamSniffer/status/1866465832668365010" rel="null" target="null" text="null" title="null">Scam Sniffer</a>
 </figcaption>
</figure>
The bot then injects a malicious PowerShell code that downloads and runs malware to compromise computer systems and crypto wallets. Scam Sniffer said it has noted “numerous cases” where similar malware led to the theft of <a data-ct-non-breakable="null" href="https://cointelegraph.com/learn/articles/private-keys-vs-seed-phrases" rel="" target="_self" text="null" title="https://cointelegraph.com/learn/articles/private-keys-vs-seed-phrases">private keys</a>.
Scam Sniffer told Cointelegraph that the recent known cases of this type of scam were all caused by the fake verification bot.
“It’s currently unclear if there are other malicious bots. However, it’s obviously simple for them to impersonate others as well,” the firm said.&nbsp;
According to Scam Sniffer, malware that targets regular users has “existed for a long time,” but the <a data-ct-non-breakable="null" href="https://cointelegraph.com/learn/articles/how-does-blockchain-work-everything-there-is-to-know" rel="null" target="null" text="null" title="null">infrastructure</a> behind such malicious software is “developing rapidly” and becoming “quite sophisticated.”
It explained that when scammers <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/phishing-attack-zoom-link-crypto-investor-loses-millions" rel="null" target="null" text="null" title="null">have successful heists and demand grows</a>, they evolve into a scam-as-a-service, similar to crypto wallet-draining software makers hiring out their tools to phishing scammers.
Scam Sniffer added while it had seen malware distributed through Telegram and instances of scammers impersonating others to trick run malicious code, “this is the first time we’re seeing this specific combination of fake X accounts, fake Telegram channels and malicious Telegram bots.”
<figure>
 <img alt="Scammers are using Telegram verification bots to inject crypto-stealing malware" src="https://s3.cointelegraph.com/uploads/2024-12/0193b393-c72d-72c2-a6cd-20ff510e5425" title="">
 <figcaption style="text-align: center;">
 The fake Safeguard bot caused all recent and known cases of this scam type. Source: <a data-ct-non-breakable="null" href="https://x.com/realScamSniffer/status/1866465802020602074" rel="null" target="null" text="null" title="null">Scam Sniffer</a>
 </figcaption>
</figure>
Meanwhile, the security firm <a data-ct-non-breakable="null" href="https://x.com/realScamSniffer/status/1866410028238041433" rel="null" target="null" text="null" title="null">said</a> it has noted a surge in scammers impersonating others on X and shilling sham links and tokens.&nbsp;
On average, Scam Sniffer’s monitoring system has found 300 X impersonators a day so far this month, compared with the November average of 160.
At least two victims have lost over $3 million from clicking malicious links and signing transactions from some of these fake accounts, it added.
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/misspelling-soneium-google-shows-crypto-phishing-link-scam-sniffer" rel="null" target="null" text="null" title="null">Misspelling Soneium on Google could drain your crypto wallet: Scam Sniffer</a>
Cado Security Labs also <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/crypto-stealing-scammers-target-web3-workers-fake-meeting-apps" rel="null" target="null" text="null" title="null">sounded the alarm that Web3 workers</a> are being targeted by a campaign using fake meeting apps to inject malware and steal credentials to websites, apps and crypto wallets.&nbsp;
Web3 security platform Cyvers similarly <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/crypto-phishing-scams-rise-holidays-9-3-m-nov-cyvers" rel="null" target="null" text="null" title="null">warned this month that phishing attacks</a> may surge in December as hackers attempt to exploit the growth in online transactions ahead of the holiday season.
Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/crypto-gaming-tokens-memecoins-gamer-coaches-parallel-web3-gamer/" rel="null" target="null" text="null" title="null">How to pick a crypto gaming token winner this bull run: Web3 Gamer</a>

Scammers are using Telegram verification bots to inject crypto-stealing malware

Cointelegraph

Other articles published on Dec 11, 2024

Chainlink Joins Forces with Coinbase for Innovation

Binance Labs Backs Innovative Solana Project

Bitcoin (BTC) Good News from VanEck Analysts: "This Data Points to a Rally!"

Febya Emerges As World’s Leading Crypto Exchange Offering Seamless Access to Top Cryptocurrencies

21Shares Introduces Four New ETPs for Pyth, Ondo, Render, and Near

PEPE Token Investor Sees 24,656x ROI, $73 Million Profit in Record Time

Join our free newsletter for daily crypto updates!