There is a new Telegram malware dubbed Elcheron, which joins crypto-focused groups in a bid to steal crypto wallets and account credentials, said SafeGuard Cyber.
According to the report, the malware is distributed among Telegram groups by a user with the “Smokes Night” handle, who spreads the malware by dropping an infected file into chat rooms without comment.
⚡️⚡️⚡️Attention, in the screenshot below is an example of an archive attachment with a preview, do not open if you will be sent to Telegram something like this (even from friends) ⚡️⚡️⚡️
As we can see, the attack with the Echelon was only a warming-up. pic.twitter.com/ABRFea1O3J
— CIA Officer (@officer_cia) December 26, 2021
“The sample of Echelon that we analyzed targets credentials, crypto wallets, and has some fingerprinting capabilities,” SafeGuard detailed. This allows the attacker to gain access to victims’ crypto assets.
However, the malware also attempts to gain access and steal credentials from multiple different messaging, File Transfer Protocol (FTP), and Virtual Private Network (VPN) platforms, which can be used for social engineering attacks in the future.
Nevertheless, users can apply some quick settings to improve security.
In the first place, they need to disable automatic media download and activate other privacy settings like limiting certain options to contacts only.
And, of course, they should never download unknown third-party files shared via any messaging or social media platform.
I'll tell you even more, the animated TG stickers were used to upload spread over Telegram, with the TG servers acting as proxies. It was enough to click on the animated sticker for remote code execution:)
So it's important to always keep this setting off.
— CIA Officer (@officer_cia) December 25, 2021
Telegram, a cross-platform messaging app, has found popularity among the crypto community for its enhanced privacy and encryption features, its support for large groups, as well as the fact that it has no ties to Meta‘s family of social media apps — i.e., Facebook, Messenger, and Instagram.
As reported, last week, investors of the Solana (SOL)-based non-fungible token (NFT) project Monkey Kingdom were robbed of their SOL tokens after a cyber thief hacked the project’s official Discord server and published a phishing link.
Source: Cryptonews
