SeguridadCriptográfica

WARNING
Crypto Scam on Telegram and Apple and Android Stores

Scammers are injecting sophisticated harmful programs through verification bots; these involve scams using malware on Telegram.

They distribute it through fraudulent verification bots used in fake trading groups. Once you run their code or install their verification software, they gain access to passwords, scan wallet files, monitor clipboards, and/or steal browser data. They create fake X accounts, posing as popular crypto influencers, and then invite users to Telegram groups with promises of great investment ideas.

Once in the group, users are asked to interact through the bot that inoculates malware, taking over access keys and emptying wallets. Another variant uses fake Cloudflare verification pages to deploy the malware, where users are asked to copy and paste the verification text that is secretly injected into their clipboard.

Additionally, for the first time, applications that steal cryptocurrencies have been detected on the Apple App Store. In reality, this occurs in Android and iOS applications in Google Play Store and Apple App Store: these contain a malicious software development kit (SDK) designed to steal cryptocurrency wallet recovery phrases through optical character recognition (OCR) thieves, capturing wallet recovery phrases, and attempting to detect and extract text from images on the device, identifying recovery phrases that can be used to load cryptocurrency wallets onto the attackers' devices without knowing the password.

The malware searches for images containing phrases and secret terms using specific keywords in different languages. Storing cryptocurrency wallet recovery phrases in screenshots is a practice that should be avoided.