A forwarded Telegram video advertises heavily discounted, high-profile cryptocurrency projects, enticing viewers with links to a seemingly legitimate second-tier exchange and a concealed malicious link. 

Through the use of this social engineering strategy, which is intended to lull victims into a false sense of security, users are most likely directed to a fraudulent platform to extract financial gain. 

The crypto project sale announcement screenshot is wrapped into a five-second video clip. That’s a red flag!

- Advertisement -

Acquiring a Ferrari or yacht using Bitcoin necessitates converting cryptocurrency into fiat currency through a reputable exchange platform. Subsequently, traditional banking channels can transfer funds to a dealership or yacht broker.

How to Build a Security Framework With Limited Resources IT Security Team (PDF) - Free Guide

While some luxury vendors may directly accept Bitcoin, due diligence is crucial to avoid scams. Securely storing Bitcoin in a cold wallet and employing robust authentication practices is paramount to protecting digital assets during these transactions. 

The text file contains carefully collected addresses, logins, passwords, seed phrases, recovery keys, PINs and private keys

Scammers employed a sophisticated social engineering attack by creating a fraudulent website displaying authentic wallet data, including transaction history and substantial asset holdings.

To build credibility, they used real, albeit empty, wallets with recent activity. 

By locking the displayed funds, they prevented immediate withdrawals while luring victims with the illusion of substantial wealth, which served as a data collection tool for potential targets before initiating the next phase of the attack.  

The amounts in the other wallets are hefty. Too bad the funds are staked (locked)

A sophisticated phishing attack targeted cryptocurrency users by disseminating a fake Telegram screenshot showcasing a lucrative Monero wallet.

The lure of a million-dollar windfall enticed victims to download a malicious “Electrum-XMR” wallet application. 

This fraudulent software, disguised as a legitimate open-source project, surreptitiously installed Backdoor.OLE2.RA-Based.a malware on victims’ systems.

The malware granted attackers remote access, enabling them to steal cryptocurrency wallet data and other sensitive information.

The seed phrase for the wallet was the bait

According to Kaspersky, following a social engineering attack that included a gradual attempt at phishing, the threat actors increased the intensity of their strategies. 

A subsequent attack leveraged a single screenshot displaying a fraudulent digital wallet with a substantial balance adjacent to a text file containing sensitive personal data and a malicious link. 

Foreshadowing a wave of similar, high-impact attacks, this condensed approach significantly increased the attack’s potency, which indicates that the initial scam was successful and indicates that the attack was successful. 

Are you from SOC and DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Free Access