Scam Sniffer Warns Fake Influencers Are Stealing Crypto Funds
You are here: Home / News / Scam Sniffer Warns Fake Influencers Are Stealing Crypto Funds
- ScamSniffer warns about fake influencer accounts targeting crypto users, leading them to malicious Telegram groups to steal assets.
- The malware, activated by the “OfficialSafeguardBot,” tricks users into quickly verifying, compromising private keys and wallets.
- Impersonation accounts increased by 87%, leading to over $3 million in losses, ScamSniffer urges users to secure assets with hardware wallets.
ScamSniffer, a Web3 security company, has warned of a new and complex scam that is currently duping cryptocurrency users. The scheme involves the fraudsters mimicking popular crypto personas and luring people to join certain Telegram groups which are essentially fraudster’s pinned groups that install malware to steal digital assets.
1/7 🚨 SECURITY ALERT: New sophisticated scam targeting crypto users through fake Telegram groups.
Attackers are impersonating multiple crypto influencers and using malicious bots for verification. Here's how it works… 🧵 https://t.co/KaetjSHW1I pic.twitter.com/YwFM5RBl3V
— Scam Sniffer | Web3 Anti-Scam (@realScamSniffer) December 10, 2024The scam starts when the fraudsters create Fake X (formerly Twitter) accounts which are almost identical to those of Popular Cryptocurrency Influencers. These fake accounts promote special groups of the popular messaging app Telegram, which are said to provide tips on investments and profitable offers. That is why scammers try to replicate real influencer accounts and use them in their fraudulent groups to make them look and feel like legitimate communities.
Tactics Used by Scammers
After a user clicks on the invite link, he or she will be asked to verify membership by interacting with a Telegram bot called OfficialSafeguardBot. As stated by ScamSniffer, the bot uses an approach that tries to force users into taking actions as fast as possible with the help of capthcas to solve. This process makes users more vulnerable to being scammed because of the haste with which they are carrying out the process.
Platform has identified several recent cases where this approach was used to steal the private keys of users. The specific malware employed in these attacks is particularly subtle and can avoid being identified by most anti-malware software. Despite this, the malware has only been detected as malicious by VirusTotal, a situation that makes it hard for users to detect the threat and prevent the loss of their money.
The platform suggests that the followers of cryptocurrencies should take some precautions to guard against these threats. Others are; storing private keys in hardware wallets, not executing any command that one is not familiar with and not installing any software from unconfirmed sources. Adopting the following measures will greatly minimize the possibility of asset theft through these scams.
DeFi Protocol Hit by Malware
This warning comes after ScamSniffer reported that there had been a increase in the creation of fake X accounts in the last month. Impersonation accounts increased by over 87% since November and caused important financial damages. Of interest, two victims lost more than $3 million each after clicking on the links that were shared by these fake accounts.
🚨 SCAM ALERT: Surge in X Impersonations 📈
Our monitoring system detected a significant increase in crypto fake accounts this week, with daily numbers reaching 300+ (vs. Nov avg. 160) 📊
⚠️ Two victims lost over $3M recently from clicking malicious links/signing transactions… pic.twitter.com/eGhG1GPX0r
— Scam Sniffer | Web3 Anti-Scam (@realScamSniffer) December 10, 2024This follows the increase in the value of cryptocurrencies, which includes BTC that hit $100,000, and the increase in the value of other cryptocurrencies commonly known as altcoins. While the crypto market is becoming more and more profitable, the number of people trying to take advantage of the growing audience is also growing.
In October, a decentralized finance protocol known as Radiant Capital lost more than $50 million when the attackers gained access to the developer systems through a PDF file containing malware in a zip file. This attack was a social engineering one and the file was delivered via Telegram by an impersonator of a former contractor.
