Search This Blog

Powered by Blogger.

Blog Archive

Labels

Showing posts with label phishing tactics. Show all posts

Report: Telegram Crypto Scammers Adopt More Sophisticated Tactics

 

Telegram, a popular communications app known for encrypted messaging and calls, has become a prime target for sophisticated malware scams, according to the Web3-focused Scam Sniffer account on X. Sharing data on the platform, Scam Sniffer revealed that scammers on Telegram are now deploying malware instead of traditional phishing tactics.

The app, often considered an alternative to WhatsApp and Signal, offers privacy through encryption, making it attractive for both legitimate users and scammers. Previously, cryptocurrency scams on Telegram relied heavily on phishing techniques involving spoofed web pages and social engineering to extract sensitive information or access to crypto wallets.

However, the latest scam wave employs deceptive tools like fake verification bots, scam trading groups, and so-called “exclusive alpha groups,” as noted by Scam Sniffer. Victims are tricked into installing malware disguised as verification tools. Once installed, the malware can access passwords, wallets, clipboard data, and even browser information, leaving victims highly vulnerable.

Scammers have shifted to malware schemes partly because users are now more aware of traditional phishing tactics. Scam Sniffer pointed out that these new approaches make it harder to trace the source of the scams. The rise in cryptocurrency scams has been dramatic, with data showing over 2000% growth in dedicated scam groups. Bitcoin's soaring value, surpassing $100,000, has made cryptocurrency users more frequent targets.

Telegram has actively banned accounts involved in these scams, but managing the volume of malicious actors remains challenging. The website “Web3 is Going Great,” which tracks Web3-related scams, reports $7.84 million in losses from scams and hacks so far this year.

This Phishing Trend is Exploiting YouTube URLs Through O365 Expiry Themes

 


A recent surge in phishing campaigns has revealed attackers leveraging cleverly obfuscated URLs and Microsoft 365 password expiry warnings to trick users into surrendering their credentials. Here's a breakdown of the latest findings:

The phishing emails consistently use subject lines formatted as: “ACTION Required - [Client] Server SecurityID:[random string]”.

The email body prompts recipients to reconfirm their passwords due to expiry, with clickable buttons labeled “Keep [USER EMAIL] Access Active.”

Tactics Employed

- Fake YouTube Links: Attackers embed links starting with seemingly legitimate URLs (e.g., youtube.com), followed by obfuscated characters like %20.

- URI Obfuscation: By including the @ symbol in URLs, attackers redirect users to malicious domains (e.g., globaltouchmassage[.]net), disguising them as trustworthy.

Key Indicators

  • URLs with excessive %20 (HTML space encoding)
  • The use of an @ symbol to split the URL:
  • Content before the @ is treated as irrelevant.
  • Content after the @ is the actual domain.
  • Redirectors and phishing kits such as Tycoon 2FA, Mamba 2FA, and EvilProxy are commonly used.
Browsers interpret URLs with @ symbols by treating everything before it as user credentials, redirecting to the domain after the @.

This tactic leverages legitimate services like YouTube to create a false sense of trust, increasing the likelihood of users clicking without inspecting the URL

To combat these threats, organizations should take a multi-pronged approach. Start by educating users to inspect URLs for anomalies such as %20 and @ symbols, and to be cautious of emails that demand immediate action on accounts or passwords. On the technical front, implement URL filtering and blocklists to prevent access to known malicious domains, and use sandbox tools to analyze suspicious links safely. Lastly, encourage employees to report any suspicious emails to the IT or security team immediately to ensure swift action and monitoring.

As phishing tactics grow more sophisticated, attackers exploit trust in legitimate platforms. Remain vigilant, verify links, and educate your workforce to stay protected.