Recently, users reported phishing attacks using fake Zoom links, resulting in stolen crypto assets worth millions. SlowMist conducted an analysis of the incident, examining the attack methods and fund movements.
Phishing Link Analysis
Attackers used a domain similar to the legitimate Zoom domain to disguise their attack. Clicking the 'Launch Meeting' button initiated the download of malicious software instead of launching the Zoom client. The analysis revealed that attackers were using the Telegram API to monitor who clicked the download button.
Malware Analysis
The malware file was named 'ZoomApp_v.3.14.dmg' and tricked users into entering their system password. It executed a script that collected and sent data to attackers, allowing access to sensitive information like passwords and crypto wallet data.
Malicious Behavior Analysis
The analysis showed that the malicious code collected system, browser, and crypto wallet data, sending it to an attacker-controlled server in the Netherlands. Using MistTrack, it was discovered that hacker addresses received over $1 million, including ETH and other cryptocurrencies, later moved to various platforms.
Phishing attacks using Zoom links pose a significant security threat, combining social engineering and trojans. SlowMist Security Team advises users to verify meeting links carefully and use antivirus software to protect their data.
