Friday, 19 July 2024

Crypto News

Chinese hackers use fake Skype app to target crypto users in new phishing scam

Chinese hackers use fake Skype app to target crypto users in new phishing scam

A new phishing scam has emerged in China that uses a fake Skype video app to target crypto users

As per a report by crypto security analytic firm SlowMist, the Chinese hackers behind the phishing scam used China’s ban on international applications as the basis of their scam, as several mainland users often search for these banned applications via third-party platforms.

Social media applications such as Telegram, WhatsApp, and Skype are some of the most common applications searched for by mainland users, so scammers often use this vulnerability to target them with fake, cloned applications containing malware developed to attack crypto wallets.

Baidu search results for Skype. Source: Baidu

In its analysis, the SlowMist team found that the recently created fake Skype application bore version number, while the latest version of Skype is actually The team also discovered that the phishing back-end domain ‘’ impersonated the Binance exchange on Nov. 23, 2022, and later changed it to mimic a Skype backend domain on May 23, 2023. The fake Skype app was first reported by a user who lost ‘a significant amount of money’ to the same scam.

The fake app’s signature revealed that it had been tampered with to insert malware, and after decompiling the app the security team discovered that it modified a commonly used Android network framework called okhttp3 to target crypto users. The default okhttp3 framework handles Android traffic requests, but the modified okhttp3 obtains images from various directories on the phone and monitors for any new images in real-time.

The malicious okhttp3 requests users to give access to internal files and images, and as most social media applications ask for these permissions anyway they often don’t suspect any wrongdoing. Thus, the fake Skype immediately begins uploading images, device information, user ID, phone number, and other information to the back end.

Once the fake app has access, it continuously looks for images and messages with TRX and ETH-like address format strings. If such addresses are detected, they are automatically replaced with malicious addresses pre-set by the phishing gang.

Fake Skype app backend. Source: Slowmist

During SlowMist testing, it was found that the wallet address replacement had stopped, and the phishing interface’s back end was shut down and no longer returned malicious addresses.

Related: 5 sneaky tricks crypto phishing scammers used last year

The team also…

Click Here to Read the Full Original Article at News…