温馨提示：本站仅提供公开网络链接索引服务，不存储、不篡改任何第三方内容，所有内容版权归原作者所有
AI智能索引来源：http://www.bee.com/vi/37762.html
点击访问原文链接

How did a fake zoom link successfully steal 1M funds? | Bee Network

进入原网站 导航首页
How did a fake zoom link successfully steal 1M funds? | Bee Network Login Tin tức thịnh hành Nền tảng khởi chạy meme Các tác nhân trí tuệ nhân tạo (AI) DeSci TopChainExplorer Dành cho Newbee Tiền xu 100 lần Trò chơi Ong Trang web cần thiết ỨNG DỤNG Phải Có Người nổi tiếng về tiền điện tử DePIN Tân binh cần thiết Máy dò bẫy Công cụ cơ bản Trang web nâng cao Trao đổi Công cụ NFT CHÀO, Đăng xuất Vũ trụ Web3 Trò chơi Ứng dụng phi tập trung (DApp) Tổ ong Nền tảng phát triển QUẢNG CÁO Tìm kiếm Tiếng Anh Nạp xu Đăng nhập Tải xuống Đại học Web3 Trò chơi Ứng dụng phi tập trung (DApp) Tổ ong QUẢNG CÁO trang chủ•Phân tích•How did a fake zoom link successfully steal 1M funds? How did a fake zoom link successfully steal 1M funds?Phân tích1 năm trước (2024)更新Wyatt 36.7111 34 When I woke up in the morning, I saw several WeChat groups spreading the news that @lsp 8940 encountered a fake zoom link and 1M USD was stolen ( https://x.com/lsp8940/status/1871350801270296709 ). This reminded me that I encountered a similar thing on the 18th. At that time, a foreigner sent me a private message asking for cooperation. We communicated several times and then made an appointment to chat in a zoom meeting at 9 pm. When the time came, the foreigner sent me a link to a conference room, as shown below

https://app.us4zoom.us/j/8083344643?pwd= seyuvstpldar 6ugeEtcGGury 936 qBCQr #success

(Important reminder, this is a phishing link, don鈥檛 click! Don鈥檛 click! Don鈥檛 click! )

I felt a little strange when I saw this link. The domain name was us4zoom , which looked a bit irregular, but I had never used zoom before so I was not sure. Then I searched on Google and perplexity and found that the official website was zoom.us, which did not match the domain name given by the scammer.

The link provided by the scammer will download an installation package. The downloaded file is a bit small and is much smaller than the normal installation package size, as shown below

When you open the fake zoom installation package, you will find an obvious problem. Normal software installation basically asks you to click Continue all the way, and then the installation is completed. For example, the interface of the real zoom installation package is as shown in the figure

The installation interface of the fake zoom installation package is as follows

What the hell is this? Why do they ask us to drag the Zoom.file file into the terminal to execute it? This is obviously a problem. I opened Zoom.file with a text editor and found that it was a bash script, but I couldn鈥檛 understand the content at all. It looked like it was encrypted.

But I was not afraid. I threw the entire content to gpt and asked gpt to help me analyze the script.

Gpt told me that this code was hidden by base 64 encoding. After decoding, I found that the main function of this script is to copy the Trojan file .ZoomApp from the installation package to the /tmp directory for execution. Because this Trojan file is hidden, it is not visible by default.

The analysis of this Trojan file is beyond my ability, and gpt cannot provide practical help. This part of the analysis requires the relay of professional security personnel. However, it can be speculated that this Trojan will scan key files for upload, such as the local files of the browser plug-in wallet. I remember that in 21 years, the private key can be recovered from the local files of metamask, provided that the set password is known or brute force cracking is used.

We can draw several conclusions from this incident:

1. The scammers are casting a wide net. @cutepanda web3 also tweeted today that he encountered the same scam.

2. This is the same scammer. From @lsp 8940 鈥檚 replay tweet, we can see that the fake zoom meeting links we both received are exactly the same.

https://x.com/lsp8940/status/1871426071499100630

3. Be cautious about private messages from strangers on Twitter, especially if the stranger has never tweeted and your mutual friends don鈥檛 follow him.

4. Try to set the browser plug-in wallet password to be more complex, so that when the browser plug-in file is leaked, it will increase the difficulty of cracking.

Safety is no small matter, I hope everyone will avoid falling into traps.

This article is sourced from the internet: How did a fake zoom link successfully steal 1M funds?

Related: LBank Labs 2024 Meme Track Research: Breaking the Circle and Rebirth, From Controversial Narratives to the 100 Billion T introduction As the crypto market matures and the industry landscape continues to evolve, Meme Coin has developed into an emerging market with a market value of over $100 billion, relying on its unique value capture model and community consensus. Against the backdrop of market volatility and a tightening regulatory environment, its resilience and vitality have triggered in-depth reflections on its core value in the industry. In order to fully grasp the development context and future trends of the Meme track, LBank Labs, MetaEra and Con ong Network jointly released the 2024 Meme Track Research: Breaking the Circle and Rebirth, From Controversial Narratives to the 100 Billion Track research report. This in-depth research report, through a systematic analysis of market size, ecological pattern, infrastructure construction, exchange layout and other dimensions, presents in…

Phân tích ## web3© 版权声明Mảng 上一 hình ảnh 7 dự đoán của Forbes cho năm 2025: Nhiều quốc gia lớn hơn sẽ triển khai dự trữ Bitcoin, và tổng giá trị thị trường của tiền điện tử sẽ... 下一 hình ảnh Economic Calendar for Cryptocurrency Traders Week 52, 2024 相关文章 Odaily Editorial Department’s Complete Investment Operation Record (November 5th) 6086cf14eb90bc67ca4fc62b 14.676 Airdrop Weekly Report | Monad will launch its public sale on November 17; Aster begins Phase 4, Aster Harvest (November 6086cf14eb90bc67ca4fc62b 18.643 Weekly Funding Roundup | 11 Projects Secure Funding, Total Raised Reaches $232 Million (Jan 12-18) 6086cf14eb90bc67ca4fc62b 8.423 Lựa chọn hàng tuần của Ban Biên tập (1018-1024) 6086cf14eb90bc67ca4fc62b 17.696 $1.5 billion black eats black: FTX and Three Arrows Capital devour each other 6086cf14eb90bc67ca4fc62b 30.068 1 Stripe for Agents: An Investment Map of Agents from Protocol Stacks to the Payment Ecosystem 6086cf14eb90bc67ca4fc62b 17.643 1 1 bình luận Bạn phải đăng nhập để co thể để lại một lơi nhận xét! Đăng nhập ngay lập tức #Beeliever2IRUBI6 Khách mời TÔI

1 năm trước (2024) Bài viết mới nhất Did Jane Street “Manipulate” BTC? Decoding the AP System, Understanding the Power Struggle Behind ETF Creation and Redemption Pricing 18 giờ trước 578 Stop Comparing Bitcoin to Gold—It’s Now a High-Volatility Software Stock 18 giờ trước 666 Matrixport Research: $25 Billion Gamma Unwinding Imminent, Liquidity Yet to Return Behind the Rebound 18 giờ trước 615 ERC-5564: Ethereum’s Stealth Era Has Arrived, Receiving Addresses No Longer ‘Exposed’ 18 giờ trước 534 Hong Kong Regulatory Green Light: Asseto Enables DL Holdings to Achieve Compliance for Two RWA Business Implementations 18 giờ trước 590 Trang web phổ biếnTempoLighterGAIBMáy bay lượnPlanckRaylsBCPokerVooi Bee.com Cổng thông tin Web3 lớn nhất thế giới Đối tác đồng xuCá chép Binance CoinMarketCap CoinGecko Coinlive Giáp Tải xuống Bee Network APP và bắt đầu hành trình web3 Giấy trắng Vai trò Câu hỏi thường gặp © 2021–2026. Tất cả quyền được bảo lưu. Chính sách bảo mật | Điều khoản dịch vụ Tải xuống ứng dụng Bee Network và bắt đầu hành trình web3 Cổng thông tin Web3 lớn nhất thế giới Đối tác CoinCarp Binance CoinMarketCap CoinGecko Coinlive Armors Giấy trắng Vai trò Câu hỏi thường gặp © 2021–2026. Tất cả quyền được bảo lưu. Chính sách bảo mật | Điều khoản dịch vụ Tìm kiếm Tìm kiếmTrong trang webOnChainXã hộiTin tức 热门推荐: Thợ săn airdrop Phân tích dữ liệu Người nổi tiếng về tiền điện tử Máy dò bẫy Tiếng Việt English 繁體中文 简体中文 日本語 العربية 한국어 Bahasa Indonesia हिन्दी اردو Русский Tiếng Việt

智能索引记录