Scammers Use Fake Zoom Links to Steal Crypto

Crypto scammers are up to no good again, and their latest weapon appears to be malicious links to a webpage that looks and feels almost exactly like the video conferencing platform Zoom. These links prompt users to install malware when clicked, leading to significant financial losses.

On July 22, non-fungible token collector and cybersecurity engineer NFT_Dreww alerted X users to a new 'extremely sophisticated' crypto scam involving fake links for Zoom. Drew reported that the scammers have already stolen $300,000 worth of crypto through this method.

How the Scam Works

Drew explained that scammers target non-fungible token (NFT) holders or crypto whales. They lure potential victims by asking if they want to license their intellectual property, invite them to Twitter Spaces, or join a team for a new project.

The scammers insist on using Zoom and hurry the target to join a meeting in progress using a hard-to-notice malicious link.

'It's straightforward to fall for this... I doubt 80% of people verify each character in a sent link, especially a Zoom link.'

Once the link is clicked, the user encounters a 'stuck' page showing an infinite loading screen. The page then prompts the user to download and install ZoomInstallerFull.exe, which is malware.

Once installed, the page redirects to the official Zoom platform, making the user believe it worked. But by then, the malware has already infiltrated the target computer and stolen data and funds.

According to technologist Cipher0091, whom Drew credits for his X thread, when the malware is first executed, it adds to the Windows Defender exclusion list to prevent antivirus systems from blocking it.

'Then it begins executing and extracting all your information while the software is distracting you with the 'spinning loading page' and going through the process of accepting T&Cs,' explained Drew. He added that the scammers keep changing domain names to prevent them from being flagged, and this was their fifth domain so far for this scam.

Evolving Tactics

Social engineering crypto scams are not new, but they keep evolving. Several crypto community members have reported receiving malicious emails from scammers impersonating other crypto influencers and executives this week. The emails contain a malicious attachment that, if executed, likely installs crypto-stealing malware.

As these scams become more sophisticated, the crypto community must stay vigilant and verify all links before clicking.