Global Economic Intersection
Advertisement
  • Home
  • Economics
  • Finance
  • Politics
  • Investments
    • Invest in Amazon $250
  • Cryptocurrency
    • Best Bitcoin Accounts
    • Bitcoin Robot
      • Quantum AI
      • Bitcoin Era
      • Bitcoin Aussie System
      • Bitcoin Profit
      • Bitcoin Code
      • eKrona Cryptocurrency
      • Bitcoin Up
      • Bitcoin Prime
      • Yuan Pay Group
      • Immediate Profit
      • BitQH
      • Bitcoin Loophole
      • Crypto Boom
      • Bitcoin Treasure
      • Bitcoin Lucro
      • Bitcoin System
      • Oil Profit
      • The News Spy
      • Bitcoin Buyer
      • Bitcoin Inform
      • Immediate Edge
      • Bitcoin Evolution
      • Cryptohopper
      • Ethereum Trader
      • BitQL
      • Quantum Code
      • Bitcoin Revolution
      • British Trade Platform
      • British Bitcoin Profit
    • Bitcoin Reddit
    • Celebrities
      • Dr. Chris Brown Bitcoin
      • Teeka Tiwari Bitcoin
      • Russell Brand Bitcoin
      • Holly Willoughby Bitcoin
No Result
View All Result
  • Home
  • Economics
  • Finance
  • Politics
  • Investments
    • Invest in Amazon $250
  • Cryptocurrency
    • Best Bitcoin Accounts
    • Bitcoin Robot
      • Quantum AI
      • Bitcoin Era
      • Bitcoin Aussie System
      • Bitcoin Profit
      • Bitcoin Code
      • eKrona Cryptocurrency
      • Bitcoin Up
      • Bitcoin Prime
      • Yuan Pay Group
      • Immediate Profit
      • BitQH
      • Bitcoin Loophole
      • Crypto Boom
      • Bitcoin Treasure
      • Bitcoin Lucro
      • Bitcoin System
      • Oil Profit
      • The News Spy
      • Bitcoin Buyer
      • Bitcoin Inform
      • Immediate Edge
      • Bitcoin Evolution
      • Cryptohopper
      • Ethereum Trader
      • BitQL
      • Quantum Code
      • Bitcoin Revolution
      • British Trade Platform
      • British Bitcoin Profit
    • Bitcoin Reddit
    • Celebrities
      • Dr. Chris Brown Bitcoin
      • Teeka Tiwari Bitcoin
      • Russell Brand Bitcoin
      • Holly Willoughby Bitcoin
No Result
View All Result
Global Economic Intersection
No Result
View All Result
Home Econ Intersect News

Telegram And WhatsApp Lookalike Websites Distribute Crypto Stealing Malware

John Wanguba by John Wanguba
March 17, 2023
in Econ Intersect News, Economics
0
0
SHARES
13
VIEWS
Share on FacebookShare on Twitter

Copycat sites for instant messaging apps like WhatsApp and Telegram are getting used to distribute some trojanized versions that infect Android and Windows users with crypto clipper malware.

Cryptocurrency Stealing Malware

ESET researchers Peter Strýček and Lukáš Štefanko stated in a new analysis:

“All of them are after victims’ cryptocurrency funds, with several targeting cryptocurrency wallets.”

While the first incident of clipper malware on the Google Play Store dates back to 2019, this development marks the first time the Android-based clipper malware has been built into instant messaging apps.

“Moreover, some of these apps use optical character recognition (OCR) to recognize text from screenshots stored on the compromised devices, which is another first for Android malware.”

The attack chain starts with the unsuspecting users clicking on some fraudulent ads on Google search results that result in hundreds of sketchy YouTube channels, which then directs them to lookalike WhatsApp and Telegram websites.

What is interesting about the latest batch of clipper malware is that it can intercept a victim’s chat and replace any sent and received crypto wallet addresses with addresses that are controlled by the threat actors.

Another cluster of clipper malware uses OCR to find and steal seed phrases by leveraging some legitimate machine learning plugin known as ML Kit on Android, which makes it possible for criminals to empty the wallets.

A third cluster is developed strategically to keep tabs on Telegram conversations for various Chinese keywords, both hard-coded and received from a server, linked to cryptos, and if so, exfiltrate the entire message, together with the username, channel or group name, to a remote server.

Telegram and WhatsApp crypto clipper malware

A fourth set of Android clippers come with extensive features and capabilities to switch the wallet address and harvest device information and Telegram data including contacts and messages.

The criminal Android APK package names include:

  • org.tgplus.messenger
  • org.telegram.messenger
  • com.whatsapp
  • org.telegram.messenger.web2
  • io.busniess.va.whatsapp

ESET insisted that it also found two Windows clusters, one that is engineered expertly to swap wallet addresses and a second group that is designed to distribute remote access trojans (RATs) in place of clippers to gain control of the infected hosts and perpetrate different crypto thefts.

All these analyzed RAT samples are mainly based on the publicly available Gh0st RAT, except one, which uses more anti-analysis runtime checks in its execution and utilizes the HP-socket library to fully communicate with its server.

Notably, these clusters represent different sets of activity possibly developed by many threat actors despite following a similar modus operandi.

Buy Bitcoin Now

The campaign, just like any other similar malicious cyber operation that was discovered in 2022, is geared specifically towards Chinese-speaking users, mostly motivated by the fact that WhatsApp and Telegram are blocked in the Asian country.

The researchers said:

“People who wish to use these services have to resort to indirect means of obtaining them. Unsurprisingly, this constitutes a ripe opportunity for cybercriminals to abuse the situation.”

Tags: clipper malwarecryptocrypto clipper malwarecrypto malwarecrypto marketcryptocurrencymalware
Previous Post

Bitcoin Explodes Past $26,800 On Fed’s $300B Injection Into US Banks, It’s A Bullish Affair…

Next Post

Tyson Foods To Close Two US Chicken Factories With Nearly 1,700 Workers

Related Posts

US Banks: The Good, The Bad, And The Ugly
Business

US Banks: The Good, The Bad, And The Ugly

by John Wanguba
March 27, 2023
What Are Bitcoin CME Gaps And How Do You Trade Them?
Business

What Are Bitcoin CME Gaps And How Do You Trade Them?

by John Wanguba
March 27, 2023
Zero-Day Spells Doom For Bitcoin ATMs
Economics

Zero-Day Spells Doom For Bitcoin ATMs

by John Wanguba
March 26, 2023
Exiled Chinese Billionaire Guo Wengui Arrested By US Authorities Linked With $1B Fraud Scheme Allegations
Econ Intersect News

Exiled Chinese Billionaire Guo Wengui Arrested By US Authorities Linked With $1B Fraud Scheme Allegations

by John Wanguba
March 26, 2023
Shibarium To Use 70% Of Each Base Transaction Fee To Burn Shiba Inu
Economics

Shibarium To Use 70% Of Each Base Transaction Fee To Burn Shiba Inu

by John Wanguba
March 25, 2023
Next Post
Tyson Foods To Close Two US Chicken Factories With Nearly 1,700 Workers

Tyson Foods To Close Two US Chicken Factories With Nearly 1,700 Workers

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Browse by Category

  • Business
  • Econ Intersect News
  • Economics
  • Finance
  • Politics
  • Uncategorized

Browse by Tags

adoption altcoins bank banking banks Binance Bitcoin Bitcoin adoption Bitcoin market Bitcoin mining blockchain BTC business China crypto crypto adoption cryptocurrency crypto exchange crypto market crypto regulation decentralized finance DeFi Elon Musk ETH Ethereum Europe FTX inflation investment market analysis Metaverse mining NFT nonfungible tokens oil market price analysis recession regulation Russia stock market technology Tesla the UK the US Twitter

Archives

  • March 2023
  • February 2023
  • January 2023
  • December 2022
  • November 2022
  • October 2022
  • September 2022
  • August 2022
  • July 2022
  • June 2022
  • May 2022
  • April 2022
  • March 2022
  • February 2022
  • January 2022
  • December 2021
  • November 2021
  • October 2021
  • September 2021
  • August 2021
  • July 2021
  • June 2021
  • May 2021
  • April 2021
  • March 2021
  • February 2021
  • January 2021
  • December 2020
  • November 2020
  • October 2020
  • September 2020
  • August 2020
  • July 2020
  • June 2020
  • May 2020
  • April 2020
  • March 2020
  • February 2020
  • January 2020
  • December 2019
  • November 2019
  • October 2019
  • September 2019
  • August 2019
  • July 2019
  • June 2019
  • May 2019
  • April 2019
  • March 2019
  • February 2019
  • January 2019
  • December 2018
  • November 2018
  • October 2018
  • September 2018
  • August 2018
  • July 2018
  • June 2018
  • May 2018
  • April 2018
  • March 2018
  • February 2018
  • January 2018
  • December 2017
  • November 2017
  • October 2017
  • September 2017
  • August 2017
  • July 2017
  • June 2017
  • May 2017
  • April 2017
  • March 2017
  • February 2017
  • January 2017
  • December 2016
  • November 2016
  • October 2016
  • September 2016
  • August 2016
  • July 2016
  • June 2016
  • May 2016
  • April 2016
  • March 2016
  • February 2016
  • January 2016
  • December 2015
  • November 2015
  • October 2015
  • September 2015
  • August 2015
  • July 2015
  • June 2015
  • May 2015
  • April 2015
  • March 2015
  • February 2015
  • January 2015
  • December 2014
  • November 2014
  • October 2014
  • September 2014
  • August 2014
  • July 2014
  • June 2014
  • May 2014
  • April 2014
  • March 2014
  • February 2014
  • January 2014
  • December 2013
  • November 2013
  • October 2013
  • September 2013
  • August 2013
  • July 2013
  • June 2013
  • May 2013
  • April 2013
  • March 2013
  • February 2013
  • January 2013
  • December 2012
  • November 2012
  • October 2012
  • September 2012
  • August 2012
  • July 2012
  • June 2012
  • May 2012
  • April 2012
  • March 2012
  • February 2012
  • January 2012
  • December 2011
  • November 2011
  • October 2011
  • September 2011
  • August 2011
  • July 2011
  • June 2011
  • May 2011
  • April 2011
  • March 2011
  • February 2011
  • January 2011
  • December 2010
  • August 2010
  • August 2009

Categories

  • Business
  • Econ Intersect News
  • Economics
  • Finance
  • Politics
  • Uncategorized
Global Economic Intersection

After nearly 11 years of 24/7/365 operation, Global Economic Intersection co-founders Steven Hansen and John Lounsbury are retiring. The new owner, a global media company in London, is in the process of completing the set-up of Global Economic Intersection files in their system and publishing platform. The official website ownership transfer took place on 24 August.

Categories

  • Business
  • Econ Intersect News
  • Economics
  • Finance
  • Politics
  • Uncategorized

Recent Posts

  • US Banks: The Good, The Bad, And The Ugly
  • 8 Ways AV Technology Helps You Build A Successful Business
  • How Is Bitcoin Impacting The African Banking Sector?

© Copyright 2021 EconIntersect - Economic news, analysis and opinion.

No Result
View All Result
  • Home
  • Contact Us
  • Bitcoin Robot
    • Bitcoin Profit
    • Bitcoin Code
    • Quantum AI
    • eKrona Cryptocurrency
    • Bitcoin Up
    • Bitcoin Prime
    • Yuan Pay Group
    • Immediate Profit
    • BitIQ
    • Bitcoin Loophole
    • Crypto Boom
    • Bitcoin Era
    • Bitcoin Treasure
    • Bitcoin Lucro
    • Bitcoin System
    • Oil Profit
    • The News Spy
    • British Bitcoin Profit
    • Bitcoin Trader
  • Bitcoin Reddit

© Copyright 2021 EconIntersect - Economic news, analysis and opinion.

en English
ar Arabicbg Bulgarianda Danishnl Dutchen Englishfi Finnishfr Frenchde Germanel Greekit Italianja Japaneselv Latvianno Norwegianpl Polishpt Portuguesero Romanianes Spanishsv Swedish