Crypto scammers have launched a new phishing attack using fake Zoom links to install malware on victims' computers.
On July 22, cybersecurity expert “NFT_Dreww” alerted the community about this sophisticated scam on X (formerly Twitter), revealing that it has already led to $300,000 in stolen cryptocurrency.
Here’s how it works: Scammers target NFT holders or crypto investors by pretending to be interested in their intellectual property or proposing collaborations. They insist on using Zoom for communication and send a link to join a meeting.
The link leads to a fake Zoom page with a loading screen that prompts users to download “ZoomInstallerFull.exe,” which is actually malware.
Once the malware is installed, it infiltrates the victim’s computer and redirects them to the real Zoom platform, making the scam less noticeable. The malware adds itself to the Windows Defender exclusion list to avoid detection and begins extracting information while the user is distracted by the fake loading process.
To stay under the radar, scammers frequently change their domain names. This is their fifth domain for this scam. Recently, there have also been reports of malicious emails from scammers posing as crypto influencers, containing attachments designed to install malware.
McAfee has discovered a new Android malware called SpyAgent that can steal private keys stored in screenshots and photos on smartphones.
Authorities in Anhui Province, China, have recently dismantled a major criminal operation that was using cryptocurrency platforms to launder large sums of money.
Scam Sniffer has reported a recent case where an individual lost $1 million in cryptocurrency by mistakenly copying a fraudulent address from their transaction history.
The FBI has issued a warning about advanced cyberattacks targeting cryptocurrency and DeFi companies, linked to North Korean hackers.