Crypto scammers have launched a new phishing attack using fake Zoom links to install malware on victims' computers.
On July 22, cybersecurity expert “NFT_Dreww” alerted the community about this sophisticated scam on X (formerly Twitter), revealing that it has already led to $300,000 in stolen cryptocurrency.
Here’s how it works: Scammers target NFT holders or crypto investors by pretending to be interested in their intellectual property or proposing collaborations. They insist on using Zoom for communication and send a link to join a meeting.
The link leads to a fake Zoom page with a loading screen that prompts users to download “ZoomInstallerFull.exe,” which is actually malware.
Once the malware is installed, it infiltrates the victim’s computer and redirects them to the real Zoom platform, making the scam less noticeable. The malware adds itself to the Windows Defender exclusion list to avoid detection and begins extracting information while the user is distracted by the fake loading process.
To stay under the radar, scammers frequently change their domain names. This is their fifth domain for this scam. Recently, there have also been reports of malicious emails from scammers posing as crypto influencers, containing attachments designed to install malware.
A new breed of cyber-attack is sweeping through crypto media, exploiting site pop-ups and wallet-connect prompts instead of smart-contract bugs.
CoinMarketCap, one of the most widely used crypto data tracking platforms, is reportedly facing a front-end security breach, with multiple users encountering a suspicious prompt to verify their wallets.
Russia’s attempt to formalize its crypto mining sector is falling short, with most miners opting to remain off the books despite new regulations.
A well-known investor at crypto VC firm Hypersphere has fallen victim to an elaborate phishing attack that wiped out a substantial portion of his personal savings.