Cryptotrader scam on Discord

[Lord777]

Discord was originally created for gamers, but thanks to a convenient system of servers, channels and private messages, various communities have been gathering in it for a long time, from study groups to clubs of interest.
There are also servers for cryptocurrency adepts. While traders are discussing HYIP altcoins on them, and investors are sharing their predictions, scammers are thinking how to cash in on both.

We will tell you what scheme the crooks are using now and how not to fall for their bait.

How scammers lure Discord users to a fake crypto exchange website by promising them free bitcoins or Ethereum.

Discord was originally created for gamers, but thanks to a convenient system of servers, channels and private messages, various communities have been gathering in it for a long time, from study groups to clubs of interest. There are also servers for cryptocurrency adepts. While traders are discussing HYIP altcoins on them, and investors are sharing their predictions, scammers are thinking how to cash in on both. We will tell you what scheme the crooks are using now and how not to fall for their bait.

A gift from a fake crypto exchange
Scammers search for victims on the cryptocurrency Discord servers and send out private messages on behalf of a "promising trading platform" that allegedly raffles off the cryptocurrency. The reasons for the attraction of unprecedented generosity vary from message to message: sometimes the crypto exchange wants to support traders in difficult times, sometimes - to attract new users. But the essence is always the same: the addressee, by the will of fortune, was chosen by the recipient of an impressive amount in Bitcoin or Ethereum!

The message in which scammers promise Ethereum for free looks something like this

The message, full of emoji, contains detailed instructions to make “picking up the gift” as easy as possible. Here is the link for registration on the crypto exchange and the code by which you can get the "won" bitcoins or Ethereum.

The link opens a site that really closely resembles a cryptocurrency exchange. Everything has been done quite well: there are adaptive layout and competent design, and various familiar elements kriptotreyderu trading platform - exchange rates, charts, order book, trading history. There are technical support and help sections, the portal is available in several languages. By all indications, the firm is serious.

Homepage of a fake crypto exchange where Bitcoin and Ethereum are handed out to Discord users

Scammers approached the creation of the portal so responsibly that they even took care of the security of their accounts. Victims are asked to set up two-factor authentication so that no one steals their coins (in this case, except for the authors of the site). You can also enable anti-phishing protection - the same as on real exchanges: a unique code is set in your account, which will then be indicated in all letters from the site to confirm that the letter did not come from a cracker. Here, of course, this function is only needed to convince visitors of the authenticity of the site.

Fraudulent site suggests enabling two-factor authentication and phishing protection

To complete the registration and receive the "User" status, the victim is offered either to make a small deposit in cryptocurrency (immediately or later), or to go through identity verification (aka Know Your Customer, or KYC). The procedure is arranged just like on the websites of some legitimate crypto-exchanges: you need to provide contact information and upload a selfie, where you will see an identity document and a piece of paper with the exchange's address, registration date and signature.

Most likely, scammers collect a database for sale: such packages of personal data, photo documents and selfies are really used to confirm identity in completely different services, including financial ones, so they are sold on the dark web for very good money. Another argument in favor of this assumption is that the victim is strictly forbidden to leave marks and extraneous inscriptions on the photo.

The page for verifying the user's identity on a fake cryptocurrency exchange offers to enter personal data, upload a photo of documents and take a confirmation selfie

After registering, it's time to activate the coveted key from the message in Discord and get a prize. The system accepts the code, and the promised bitcoins or Ethereum are displayed on the victim's account. But the most interesting thing begins if the victim tries to withdraw them from the exchange to his wallet.

Scammers remind that this cannot be done without a user status, and ask to top up the account balance, in our case - by 0.02 bitcoin or the approximate equivalent of this amount in Ethereum or US dollars. Obviously, the victim will no longer see this money, as well as the promised prize.

Fake crypto exchange asks to top up the balance so that the victim can withdraw the won coins

There are several such fake crypto exchanges operating on the Internet. On forums and sites with reviews, you can already find many warnings from those who have encountered these exchanges.

How to protect yourself from scammers
Here are some simple rules:

• Be careful not to trust strangers, especially if they offer something for free in messages flavored with emoticons.
• Do not share personal information with sites that you do not trust 100%.
• This is especially true of photographs of documents - this is a valuable prey for any intruder, take care of them and do not send them to anyone.
• To avoid being bombarded with tempting offers in the messenger, set up your privacy properly on Discord.
• Use a reliable security solution. For example, Kaspersky Internet Security will not only warn you about phishing sites, but also protect your computer from malware.

kasperskydaily.com

 

[Tomcat]

Hackers have turned Discord into a password stealing tool​

Edition Bleeping Computer warns that the new version of trojan steals passwords and AnarchyGrabber tokens users disable 2FA and distribute malware among the friends of the victim. And for all this, attackers modify the official Discord client.

Typically, attackers distribute AnarchyGrabber via Discord, posing as a game cheat, hacking tool, or pirated software. If the victim has taken the bait, after installation, the Trojan modifies the JavaScript files of the Discord client to turn it into malware that can steal the user's token. Using this token, hackers are able to enter Discord as their victim.

However, a new version of AnarchyGrabber was spotted last week, containing a number of new features. Now the malware is called AnarchyGrabber3, steals passwords of victims in plain text format, and can also use the infected Discord client to further spread the threat to all the victim's friends. It is noted that passwords stolen in this way can be used to hack accounts on other sites.

After installation, AnarchyGrabber3 uses the% AppData% \ Discord \ [version] \ modules \ discord_desktop_core \ index.js file of the Discord client to download other JavaScript files added by the malware. As you can see in the illustration below, when Discord starts, the modified script loads a file named inject.js from the new 4n4rchy folder.

This file will then upload another malicious file, discordmod.js, to the client. These scripts log out the user from the Discord client and prompt them to re-enter the offer.
Once the victim logs in, the modified Discord client tries to disable two-factor authentication for the account. The client then uses a webhook to send the email address, username, token, plain text password, and IP address to a special Discord channel controlled by the attackers.

After that, the "tweaked" Discord client awaits further commands from their operators. One of them can order hacked Discord clients to send malicious messages to all friends of the victim, containing the same malware. The researchers write that this component makes it easier for criminals to spread AnarchyGrabber3, and can also be used to spread other types of malware.

The publication warns that the main danger of AnarchyGrabber is that most of its victims do not even know that they have been infected. So, after launching the AnarchyGrabber3 executable file and modifying the Discord client files, the Trojan practically does not manifest itself in any way and does not start again. That is, there is simply no malicious process that could be detected by an antivirus, and the infected computer still remains part of the botnet.
In fact, the only way to uninstall AnarchyGrabber3 is to uninstall the Discord client and reinstall it.