Fake Screenshot Lures Target Web3 Support Staff with Multi-Stage Malware Attack

Fake screenshot links are being used to quietly deploy a multi‑stage backdoor against Web3 customer support teams, in a campaign assessed to be linked to the Chinese financially motivated group APT‑Q‑27 (GoldenEyeDog).

The operation abuses live chat workflows, signed .NET loaders, AWS S3 dead drops, and DLL sideloading to land a memory‑resident Farfli backdoor that talks to dozens of hard‑coded command‑and‑control (C2) servers over a non‑standard port.

The attack begins in a support chat, where an attacker posing as a user shares what looks like a screenshot link, complete with a “Google”‑looking URL and a filename that resembles a photo.

On Windows systems with default settings, the executable extension is hidden, so the file appears harmless even though it is actually a .pif program.

When opened, it shows a fake error image or opens in Microsoft Paint, giving the impression of a broken link while silently launching a .NET downloader in the background.

1inch and zeroShadow uncovers an active APT-Q-27 campaign targeting web3 customer support teams via live chat.

This first‑stage malware, signed with a legitimate but abused EV certificate, reaches out to an AWS S3 “dead drop” manifest (for example, y.txt or A.txt) that lists second‑stage payload URLs.

It creates a hidden staging directory under the user’s AppData that impersonates a Windows Update cache and includes a distinctive “@27” tag, then pulls down a bundle of DLLs, executables, logs, and images into that path.

Persistence is established via a Run registry key pointing to a fake “SystemUpdats” value, ensuring the malware survives reboots without obvious user prompts.

Obfuscation, staging, and sideloading

The .NET loaders (including variants such as Feedback.exe and photo2025060268jpg.exe) are heavily obfuscated, with all meaningful strings decrypted at runtime through a custom scheme and some key values hidden behind double Base64 encoding.

Anti‑debug checks, stack inspection, and junk control flow frustrate static analysis and sandboxes, while flexible manifest parsing allows operators to rotate infrastructure or encode URLs without changing the binary.

The binary calls the Win32 API IsDebuggerPresent and additionally performs a stack trace inspection, examining the call stack to determine whether execution is occurring within a debugger context.

If the S3 dead drop is unavailable, the loaders can fall back to downloading legitimate Microsoft VC++ redistributables, blending into normal software installation traffic.

Once staged, the chain abuses a legitimate YY platform binary (updat.exe) for DLL sideloading.

Because this signed executable imports vcruntime140.dll and msvcp140.dll, malicious replacements dropped into the working directory are loaded instead of the real runtime, which in turn load crashreport.dll and decrypt an encrypted log file (yyext.log) into memory.

That log actually contains shellcode which decompresses a UPX‑packed PE, ultimately unpacking a 32‑bit Farfli backdoor DLL fully in memory, leaving no standalone implant on disk.

The final Farfli stage maintains a list of 37 hard‑coded C2 IP addresses, protected by a rolling XOR string encryption scheme and contacted over TCP port 15628, a port repeatedly seen in previous reporting on this family.

The implant focuses on stealth and persistence: it checks for administrative context, tampers with User Account Control (UAC) registry keys to suppress prompts, registers itself as a Windows service under the name “Windows Eventn,” and uses watchdog loops to relaunch if killed.

The binary’s string heap is entirely empty, there are no readable strings are present in the .NET metadata, and static analysis tools that rely on the #US heap to recover string literals will find nothing of value. 

Some of the infrastructure overlaps with networks and ASNs previously tied to APT‑Q‑27/GoldenEyeDog, a group known for targeting gambling and cryptocurrency ecosystems using modular backdoors such as Farfli and Silver Fox.

Attribution is not definitive, but overlaps span tooling, infrastructure, and behaviours: the @27 tag in staging paths, abuse of Chinese‑registered EV certificates, use of YY binaries for sideloading, and long‑lived C2 nodes in Asian hosting.

This campaign also marks a strategic shift for the group from SEO‑driven watering holes and fake download sites to direct engagement with front‑line staff in live support channels, exploiting the high‑trust, high‑speed nature of Web3 support workflows.

Detection and practical defenses

For defenders, several high‑fidelity host and network indicators emerge from this chain. On endpoints, monitor for creation of AppData paths mimicking Windows Update with “@27” in the folder name, registry Run entries named “SystemUpdats,” new services called “Windows Eventn,” and UAC settings (EnableLUA, ConsentPromptBehaviorAdmin, PromptOnSecureDesktop) being set to 0 in close succession.

Once the payload components are in place, the malware writes a value to HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run pointing to updat.exe in the staging directory.

In memory, hunting for the specific 16‑byte XOR key and the config delimiter stimiter string “|#$|” can surface active implants, while on the wire, any outbound traffic over TCP port 15628 to the documented C2 IP ranges should be blocked and investigated.

Equally important is hardening the human and platform side of support operations. Enforcing visible file extensions on Windows, sandboxing file handling for support agents, and adding guardrails around clicking or executing files received via chat can drastically reduce risk from look‑alike “screenshot” links.

For Web3 firms, where a compromised support workstation can quickly translate into drained wallets or hijacked admin sessions, treating support environments as high‑value assets complete with strict EDR coverage, least‑privilege access, and dedicated phishing training has now become a baseline control, not a luxury.

Indicators Of Compromise (IOCs)

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.