Scammers are using Telegram verification bots to inject crypto-stealing malware

Cointelegraph

Scammers are combining social engineering with phony Telegram verification bots that inject crypto-stealing malware into systems to raid crypto wallets, blockchain security firm Scam Sniffer has warned.

In a Dec. 10 X post, Scam Sniffer said scammers are creating fake X accounts impersonating popular crypto influencers, then inviting users to Telegram groups with promises of investment insights.

Once in the Telegram group, users are asked to verify through “OfficiaISafeguardBot,” a fake verification bot that “creates artificial urgency” with short verification windows, the firm said.

The bot then injects a malicious PowerShell code that downloads and runs malware to comprise computer systems and crypto wallets. Scam Sniffer said it has noted “numerous cases” where similar malware led to the theft of private keys.

Scam Sniffer told Cointelegraph that the recent known cases of this type of scam were all caused by the fake verification bot.

“It’s currently unclear if there are other malicious bots. However, it’s obviously simple for them to impersonate others as well,” the firm said.

According to Scam Sniffer, malware that targets regular users has “existed for a long time,” but the infrastructure behind such malicious software is “developing rapidly” and becoming “quite sophisticated.”

It explained that when scammers have successful heists and demand grows, they evolve into a scam-as-a-service, similar to how crypto wallet-draining software makers hire out their tools to phishing scammers.

Scam Sniffer added while it had seen malware distributed through Telegram and instances of scammers impersonating others to trick run malicious code, “this is the first time we’re seeing this specific combination of fake X accounts, fake Telegram channels and malicious Telegram bots.”

Meanwhile, the security firm said it has noted a surge in scammers impersonating others on X and shilling sham links and tokens.

On average, Scam Sniffer’s monitoring system has found an average of 300 X impersonators a day so far this month, compared to the November average of 160.

At least two victims have lost over $3 million from clicking malicious links and signing transactions from some of these fake accounts, it added.

Cado Security Labs has also sounded the alarm that Web3 workers are being targeted by a campaign using fake meeting apps to inject malware and steal credentials to websites, apps and crypto wallets.

Web3 security platform Cyvers similarly warned this month that phishing attacks could surge in December as hackers attempt to exploit the growth in online transactions ahead of the holiday season.

Risk Warnings and Disclaimers

You understand and acknowledge that there is a high degree of risk involved in trading. Following any strategies or investment methods may lead to potential losses. The content on the site is provided by our contributors and analysts for information purposes only. You are solely responsible for determining whether any trading assets, securities, strategy, or any other product is suitable for investing based on your own investment objectives and financial situation.

Risk Disclosure

The risk of loss in trading financial instruments such as stocks, FX, commodities, futures, bonds, ETFs and crypto can be substantial. You may sustain a total loss of the funds that you deposit with your broker. Therefore, you should carefully consider whether such trading is suitable for you in light of your circumstances and financial resources.

No decision to invest should be made without thoroughly conducting due diligence by yourself or consulting with your financial advisors. Our web content might not suit you since we don't know your financial conditions and investment needs. Our financial information might have latency or contain inaccuracy, so you should be fully responsible for any of your trading and investment decisions. The company will not be responsible for your capital loss.

Without getting permission from the website, you are not allowed to copy the website's graphics, texts, or trademarks. Intellectual property rights in the content or data incorporated into this website belong to its providers and exchange merchants.

Recent Searches

Top Searches

Markets

Analysis

User

24/7

Economic Calendar

Education

Data

Scammers are using Telegram verification bots to inject crypto-stealing malware

Risk Disclosure