Chinese hackers use fake Skype app to target crypto users in new phishing scam

A caller phishing scam has emerged successful China that uses a fake Skype video app to people crypto users

As per a report by crypto information analytic steadfast SlowMist, the Chinese hackers down the phishing scam utilized China’s prohibition connected planetary applications arsenic the ground of their scam, arsenic respective mainland users often hunt for these banned applications via third-party platforms.

Social media applications specified arsenic Telegram, WhatsApp, and Skype are immoderate of the astir communal applications searched for by mainland users, truthful scammers often usage this vulnerability to people them with fake, cloned applications containing malware developed to onslaught crypto wallets.

Baidu hunt results for Skype. Source: Baidu

In its analysis, the SlowMist squad recovered that the precocious created fake Skype exertion bore mentation fig 8.87.0.403, portion the latest mentation of Skype is really 8.107.0.215. The squad besides discovered that the phishing back-end domain ‘bn-download3.com’ impersonated the Binance speech connected Nov. 23, 2022, and aboriginal changed it to mimic a Skype backend domain connected May 23, 2023. The fake Skype app was archetypal reported by a idiosyncratic who mislaid 'a important magnitude of money' to the aforesaid scam.

The fake app's signature revealed that it had been tampered with to insert malware, and aft decompiling the app the information squad discovered that it modified a commonly utilized Android web model called okhttp3 to people crypto users. The default okhttp3 model handles Android postulation requests, but the modified okhttp3 obtains images from assorted directories connected the telephone and monitors for immoderate caller images successful real-time.

The malicious okhttp3 requests users to springiness entree to interior files and images, and arsenic astir societal media applications inquire for these permissions anyhow they often don’t fishy immoderate wrongdoing. Thus, the fake Skype instantly begins uploading images, instrumentality information, idiosyncratic ID, telephone number, and different accusation to the backmost end.

Once the fake app has access, it continuously looks for images and messages with TRX and ETH-like code format strings. If specified addresses are detected, they are automatically replaced with malicious addresses pre-set by the phishing gang.

Fake Skype app backend. Source: Slowmist

During SlowMist testing, it was recovered that the wallet code replacement had stopped, and the phishing interface’s backmost extremity was unopen down and nary longer returned malicious addresses.

Related: 5 sneaky tricks crypto phishing scammers utilized past year

The squad besides discovered that a TRON concatenation code (TJhqKzGQ3LzT9ih53JoyAvMnnH5EThWLQB) received astir 192,856 USDT until Nov. 8 with a full of 110 transactions made to the address. At the aforesaid time, different ETH concatenation code (0xF90acFBe580F58f912F557B444bA1bf77053fc03) received astir 7,800 USDT successful 10 deposit transactions.

In all, much than 100 malicious addresses linked to the scam were uncovered and blacklisted.

Magazine: Thailand’s $1B crypto sacrifice, Mt. Gox last deadline, Tencent NFT app nixed