城里出现了新的黑客行为——加密货币用户警告称，要警惕伪装成 Zoom 会议链接的网络钓鱼攻击
Victims are prompted to click a “Launch Meeting” button, which they expect to take them to a Zoom session. However, instead of opening the Zoom application, the button initiates the download of a malicious file titled “ZoomApp_v.3.14.dmg.”
Malware execution and data theft ploy uncovered
Once downloaded, the malicious file triggers a script that requests the user’s system password. The script executes a hidden executable named “.ZoomApp,” which is designed to access and collect sensitive system information, including browser cookies, KeyChain data, and cryptocurrency wallet credentials.
Per security experts, the malware is specifically tailored to target cryptocurrency users, with the intention of stealing private keys and other crucial wallet data. The downloaded package, once installed, will run a script called “ZoomApp.file.”
Upon execution, the script prompts users to enter their system password, unknowingly giving hackers access to sensitive data.
After decrypting the data, SlowMist revealed that the script ultimately executes an osascript, which transfers collected information to the attackers’ backend systems.
SlowMist also traced the phishing site’s creation to 27 days ago, suspecting the involvement of Russian hackers. These hackers have been using Telegram’s API to monitor activity on the phishing site, tracking whether anyone clicked the download link. According to the security company’s analysis, the hackers began targeting victims as early as November 14.
Stolen funds moved through several exchanges
SlowMist used the on-chain tracking tool MistTrack to investigate the movements of stolen funds. The hacker’s address, identified as 0x9fd15727f43ebffd0af6fecf6e01a810348ee6ac, has reportedly profited more than $1 million in cryptocurrency, including USD0 , MORPHO, and ETH.
In a detailed analysis, MistTrack revealed that the hacker address had exchanged USD0 and MORPHO for 296 ETH.
Further investigation showed that the hacker’s address received small ETH transfers from another address, 0xb01caea8c6c47bbf4f4b4c5080ca642043359c2e, which appeared to be responsible for providing transaction fees for the hacker’s scheme.
The address has been found to transfer small amounts of ETH to nearly 8,800 other addresses, suggesting it may be part of a larger platform dedicated to funding transaction fees for illicit activities.
Once the stolen funds were gathered, they were funneled through various platforms. Binance, Gate.io, Bybit, and MEXC were among the exchanges that received the stolen cryptocurrency. The funds were then consolidated into a different address, with transactions flowing into several exchanges, including FixedFloat and Binance. There, the stolen funds were converted into Tether (USDT) and other cryptocurrencies.
The criminals behind this scheme have managed to evade direct capture by using complex methods to launder and convert their illicit gains into widely-used cryptocurrencies. SlowMist warned crypto enthusiaststhat the phishing site and associated addresses may continue to target unsuspecting cryptocurrency users.
From Zero to Web3 Pro: Your 90-Day Career Launch Plan
相关文章
投资先进芯片与晶圆代工厂股票
TradingKey - 每一波技术革命都有其基础，而当今数字经济的基石就是半导体产业。无论是智能手机、人工智能，还是数据中心与电动车，高端芯片都是支撑现代生活的核心系统。背后起关键作用的则是晶圆代工厂——专门制造他人设计的芯片企业。随着性能、效率和规模需求的持续攀升，投资高端芯片和代工厂股票已成为最佳的长期机会之一。
美国二季度GDP点评：增速反弹难持续，美股后市行情如何研判？
TradingKey - 2025年9月25日，美国公布了第二季度GDP数据最终值。数据显示，当季实际GDP年化环比增速为3.8%，高于7月、8月公布的3%和3.3%预估值。此次上修的主要原因是消费者支出超预期增长以及因抢进口效应消退导致的净出口额上升。
美国8月PCE预告：通胀“四连反弹”令美联储“三连降息”泡汤？
TradingKey - 美国商务部将于9月26日周五公布8月个人消费支出物价指数（PCE）报告，人们将继续关注美国关税的传导效应到了何种程度。即便8月CPI通胀报告符合预期、美联储预计年内仍有两次降息，但潜在连续四个月加速的通胀进展仍可能削弱多次宽松预期。
【路透分析】AI繁荣带火智能投顾市场："请问ChatGPT，我该买什么股票？"
路透伦敦9月25日 - ChatGPT问世将满三周年，现在至少有10%的散户投资者正在使用聊天机器人选股，由此带动智能投资顾问市场的红火。然而，即便是支持者也承认，AI选股是一种高风险策略，目前还抢不了传统投资顾问的饭碗。由于人工智能(AI)的飞速发展，现在人人可以选股、监控股票走势并获得投资分析建议。这在以前可是只提供给大银行或机构投资者的服务。根据数据分析公司Research and Markets，预计到2029年，所有提供自动化管理、算法驱动的金融咨询服务公司营收将从去年的617.5亿美元增至4,709.1 亿美元，增幅约为 600%。这类公司包括金融科技公司、银行和财富管理公司。曾在...
