North Korean 'Fake Zoom' Crypto Hacks: A Daily Threat

North Korean ‘fake Zoom’ crypto hacks now a daily threat: SEAL

Summary:
The Security Alliance (SEAL) has reported a rise in daily scams executed by North Korean hackers using fake Zoom meetings. This deceptive tactic involves manipulating victims into downloading malware, which allows hackers to access sensitive information. Over $300 million has reportedly been stolen through these scams.

Key Takeaways:

North Korean hackers are increasingly using fake Zoom calls to scam individuals through malware.
Victims are lured via familiar contacts on Telegram, leading to fake Zoom meetings.
Tactics include using real video clips and feigning technical issues to push malware.
Victims should take immediate action to secure their accounts and devices if they suspect a scam.

Understanding the Fake Zoom Call Scam

According to security researcher Taylor Monahan, the scam typically starts with a message from a Telegram account of someone the victim knows, creating a false sense of trust. This conversation usually transitions into an invitation for a Zoom call.

"They'll provide a link to the call that appears legitimate," she stated. "During the call, victims can see the scammer along with some of their partners or colleagues. These videos are not deepfakes as has been widely suggested; they are actual recordings from previous hacks or public sources."

Once the Zoom call is initiated, the hackers will create a ruse by pretending there are audio problems. They then send a script for a patch file, which, if opened, infects the user’s device with malware. Afterward, they will terminate the call, claiming they need to reschedule.

Related: Upbit hack puts Binance’s emergency freeze policy under scrutiny

Steps to Take If You’ve Clicked on a Malware Link

Monahan highlights that anyone who suspects they have clicked a malicious link during a Zoom call should follow these steps immediately:

Disconnect from WiFi and shut down the affected device.
Use a separate device to transfer cryptocurrency to new wallets.
Change all passwords and enable two-factor authentication wherever possible.
Perform a complete memory wipe on the infected device before using it again.

It is also crucial to secure Telegram accounts. Monahan suggests opening Telegram on a phone, navigating to settings, checking connected devices, terminating all other sessions, changing the password, and updating or adding multifactor authentication.

She warned that hackers are gaining access to Telegram accounts and utilizing the contacts stored there to find and scam new victims.

Taylor Monahan
Magazine: Meet the onchain crypto detectives fighting crime better than the cops