Elusive Comet: How Cybercriminals Are Using Zoom to Steal Cryptocurrency

In today’s digital landscape, cybersecurity threats are becoming increasingly sophisticated. One of the latest and most alarming threats comes from a group known as Elusive Comet, who are employing a clever mix of social engineering and advanced malware tactics to target cryptocurrency enthusiasts. These attackers have already swindled millions from unsuspecting victims, using Zoom as their primary platform to establish trust before executing their malicious plans. Here’s how Elusive Comet is operating, what makes their tactics so effective, and how you can protect yourself from becoming their next target.

The Mechanics of the Elusive Comet Attack

The Elusive Comet group has been using sophisticated social engineering techniques to deceive cryptocurrency users into installing malware on their devices. These cybercriminals rely on creating a false sense of legitimacy through their well-crafted online presence, which includes running seemingly reputable websites and active social media profiles. By leveraging this false trust, they gain access to unsuspecting victims, who are lured into a carefully staged Zoom meeting that leads to devastating consequences.

Victims of the Elusive Comet attack are typically contacted through direct messages on X (formerly Twitter) or via email. Often, these messages appear to be from legitimate sources, such as invitations to appear on a popular podcast like The OnChain Podcast. Once the victim accepts the offer, the attackers schedule a Zoom call. Here, they proceed to establish a rapport, sometimes withholding meeting details until the last minute to increase the victim’s sense of urgency.

Once the victim joins the Zoom call, they are asked to share their screen, under the pretext of discussing their work. This is where the attackers take advantage of their target’s trust. They request remote control of the victim’s device, and once granted, they proceed to install either an infostealer or a remote access Trojan (RAT). These types of malware allow the attackers to exfiltrate sensitive information, including cryptocurrency wallet details, banking information, and personal files. The stolen data is then either transmitted immediately or harvested for later use.

This campaign has already resulted in significant financial losses. As per the Open Security Alliance, Elusive Comet’s well-executed operations have swindled millions from crypto users, and its methods continue to evolve, posing a growing threat to online security.

What Undercode Says:

The tactics employed by Elusive Comet demonstrate an increasingly common trend in cybercrime: the blending of social engineering with technical exploits. The attackers don’t rely solely on technical vulnerabilities but instead manipulate human psychology, creating a scenario where the victim willingly grants access to their system. This makes it particularly dangerous because even the most technically savvy individuals can fall prey to these attacks if they are caught off guard by a seemingly legitimate interaction.

The use of Zoom as an attack vector is also telling. The platform is widely trusted and regularly used for professional meetings, making it the perfect vehicle for attackers to exploit. By asking victims to share their screen and grant remote control, the attackers bypass traditional cybersecurity measures, such as firewalls and antivirus software, which may not be effective against this kind of social engineering attack.

One critical aspect of the Elusive Comet attack that should not be overlooked is their ability to create a false sense of urgency. By withholding details about the meeting and pushing the victim to act quickly, the attackers capitalize on the natural human tendency to rush into decisions when under pressure. This is an important insight into why such attacks are so effective, as they prey on the victim’s emotional response rather than solely on technical weaknesses.

This campaign is also noteworthy because it highlights the intersection between social media and cybersecurity threats. The attackers use legitimate platforms like X and LinkedIn to build trust with potential victims, blurring the lines between professional networking and malicious intent. By appearing to be part of a reputable venture capital firm or media outlet, they gain the victim’s confidence before executing the attack.

To counter such sophisticated attacks,

It’s also recommended to disable the remote control feature on Zoom or similar video conferencing platforms unless absolutely necessary, and to be mindful of the permissions granted during video calls. A simple precaution like this can go a long way in mitigating the risk posed by attackers like Elusive Comet.

Fact Checker Results

Zoom Exploit: Zoom meetings are indeed a known attack vector for social engineering-based cybercrimes, including scams involving remote access Trojans (RATs).
Social Engineering Tactics: The manipulation of emotions, urgency, and trust are recognized as effective strategies in modern cyberattacks.
Known Attacks: The details regarding Elusive Comet’s operations align with known cybercrime techniques, including fake podcast invitations and social media-based recruitment.