Bad actors are deploying cryptocurrency-stealing malware using a sophisticated combination of fake X accounts and malicious Telegram bots. 
Web3 security firm ScamSniffer has <a href="https://x.com/realScamSniffer/status/1866465802020602074" target="_blank" rel="nofollow">warned</a> of a new scam targeting cryptocurrency users by mimicking popular influencers in the space and draining their wallets using stealthy malware. 
The attack begins when the scammers create fake X accounts posing as popular cryptocurrency influencers and promoting Telegram groups that promise to offer investment advice. These groups are often touted as “exclusive” and are typically promoted under the posts of the influencers that the scammers are imitating to make them look legitimate.&nbsp;&nbsp; 
When unsuspecting users join the group via the invite link, they are asked to verify using a Telegram verification bot dubbed “OfficialSafeguardBot” which, according to ScammSniffer, “creates artificial urgency” by giving users very little time to complete the captcha. 
 You might also like: <a rel="" href="https://crypto.news/cado-security-labs-flags-new-malware-targeting-crypto-wallets-on-windows-and-macos/"> Cado Security Labs flags new malware targeting crypto wallets on Windows and macOS </a> 
During this phony verification process, the bot injects “malicious PowerShell code,” a scripting language used for task automation in Windows, into the victim’s clipboard, and victims are tricked into executing it on Windows as the bot prompts it as a step required to complete the verification process. See below. 
<figure class="wp-block-image">
 <img decoding="async" src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXclH2tUCZNPbtX3cd8Rld9zrAYlucqCqedtsqqR-r6i97A_PTVBDxN79Q2cG1TVHPqCb4fqsHti_IWA1YKkZ3wsU_gPBb0RdLPov136CkCx_1CldJA2F05Kr0MYuLhbC9fx89bB?key=PZD9RSXF7azL6zrpQJX0iQQQ" alt="Scam Sniffer warns of fake Influencers and Telegram bots spreading crypto-malware - 21">
 <figcaption class="wp-element-caption">
 Telegram verification bot prompting users to run malicious code. Source: ScamSniffer on X
 </figcaption>
</figure> 
According to ScamSniffer, there have been “numerous cases recently” where <a href="https://crypto.news/giga-whale-loses-6-09m-after-clicking-a-malicious-zoom-link-report/" target="_blank">similar tactics</a> have been used to steal a user’s private keys. The malware has also managed to bypass several antiviruses, with only VirusTotal flagging it as malicious. 
To protect oneself, it advised users to use hardware wallets, avoid executing unknown commands, and avoid installing unverified software. 
The report follows an earlier <a href="https://crypto.news/scam-sniffer-crypto-fakes-on-x-nearly-doubled-reaching-over-300-accounts-daily/" target="_blank">warning</a> for ScamSniffer about a surge in fake X accounts in December. Notably, impersonation accounts have spiked over 87% since November, and two victims lost over $3 million by clicking malicious links promoted via some of these accounts. 
Over the past months, threat actors have increasingly <a href="https://crypto.news/beware-of-clipper-malware-binance-warns-of-crypto-fraud/" target="_blank">resorted to using malware</a> designed to drain crypto assets. This surge coincides with Bitcoin’s rally to $100,000 and a broader rise in altcoins, making the crypto sector increasingly lucrative for scammers. 
On Dec. 9, Cado Security Labs flagged the Realst malware infiltrating users’ systems using a fake meeting application after social engineering them into believing they needed to download the application for a legitimate business opportunity or interaction with a trusted contact.&nbsp; 
Once <a href="https://crypto.news/cado-security-labs-flags-new-malware-targeting-crypto-wallets-on-windows-and-macos/" target="_blank">deployed</a>, the malware steals crypto assets, browser-stored credentials, banking card details, and other sensitive information. 
In October, the decentralized finance protocol Radiant Capital <a href="https://crypto.news/dprk-linked-hackers-social-engineered-50m-radiant-capital-exploit-report/" target="_blank">lost</a> over $50 million after the systems of some of the platform’s developers were compromised via a zipped PDF file containing malware. The attack involved social engineering, with the infected file being promoted via Telegram by an attacker impersonating a trusted former contractor. 
 Read more: <a rel="" href="https://crypto.news/post-mortem-reveals-stealthy-malware-injection-led-to-50m-radiant-capital-exploit/"> Post-mortem reveals stealthy malware injection led to $50m Radiant Capital exploit </a>

Scam Sniffer warns of fake Influencers and Telegram bots spreading crypto-malware

crypto.news

Other articles published on Dec 11, 2024

Chainlink joins forces with Coinbase’s Project Diamond for tokenized asset management

3 hidden gems with 9,000% growth potential in December’s bull market

Meta contractor dismissed threats of attack on Facebook content moderators by Ethiopian rebels

Cardano (ADA) Price Prediction for November 11

Cardano Mirrors 2020 Trends: Is a $4 to $6 Bullish Surge Possible?

XRP’s Wave 4 Analysis Reveals $4-$5 Short-Term Targets, Larger Projections Ahead

Join our free newsletter for daily crypto updates!