Crypto scammers use Telegram to steal digital assets

Modern technologies simplify not only users' lives but also create opportunities for malicious actors. One of the most common methods of cryptocurrency theft has become Telegram, through which scammers successfully lure victims using fake accounts and malicious software.

The start of the attack: impersonating crypto influencers

The scam scheme begins on the social network X (formerly Twitter), where malicious actors create fake accounts. These accounts are disguised as well-known cryptocurrency experts or bloggers who have earned trust within the community. Using their names, scammers actively publish enticing posts offering free investment advice or "unique" earning opportunities.

The goal of such publications is to attract users to specially created Telegram groups that appear to be exclusive investment clubs. Once a person joins this group, they become part of a well-thought-out manipulative scheme.

Fake bot on Telegram: the verification trap

In Telegram groups, participants are offered to undergo a "verification" process via a bot named OfficiaISafeguardBot. The bot is designed to create a sense of urgency. For example, users are informed that the process must be completed within a strictly limited time, otherwise access to "exclusive information" will be lost.

During the verification stage, the bot stealthily injects malicious PowerShell code into the user's device system. This code automatically launches programs for stealing cryptocurrency wallet data, including passwords, private keys, and other confidential information.

How the malicious software works

Malicious actors use malware to access victims' digital assets. The programs allow them to:

• Read data from cryptocurrency wallets.
• Gain access to backup copies.
• Transfer stolen funds to addresses controlled by the scammers.

As a rule, such actions are carried out unnoticed until the user discovers the loss of their assets.

How to protect yourself from crypto scammers

To avoid such situations, it is important to take precautionary measures:

1. Verify social media accounts. Ensure that you are dealing with a genuine crypto expert account. Suspicious accounts often have a small number of followers or were recently created.
2. Ignore suspicious Telegram groups. Never follow invitations to groups promising "quick profits".
3. Do not interact with unknown bots. Especially if they request personal data, keys, or the installation of additional software.
4. Use antivirus software. Modern programs are capable of detecting malicious code and protecting the system.
5. Regularly update wallet software. This will help protect your assets from vulnerabilities.

Conclusion

Fraud using Telegram and malware is a serious threat to cryptocurrency owners. It is important to remember that promises of quick profits and exclusive opportunities are often a trap set by malicious actors. Thorough verification of information sources, caution when interacting with suspicious accounts, and the use of modern security tools will help keep your digital assets safe.