Chinese Hackers Exploit Fake Skype in Crypto Phishing Scam (2)

Impersonation of Binance Resurfaces The investigation uncovers a connection to a prior phishing attempt involving the same criminal group. The backend domain, 'bn-download3.com,' originally posed as Binance on 23 November 2022. These apps tamper with network traffic to replace legitimate cryptocurrency wallet addresses with those controlled by the attackers. Impact on Crypto Users SlowMist's analysis reveals substantial financial losses, with a TRON chain address receiving 192,856 USDT through 110 transactions. Another ETH chain address saw approximately 7,800 USDT stolen in 10 transactions, mainly through BitKeep's Swap service, using OKX for transaction fees. Urging increased vigilance, SlowMist advises users to exercise caution, especially when downloading apps from unverified sources. Relying on official app sources reduces the risk of falling victim to such fraudulent schemes.