Wu said that he learned that SlowMist sent a tweet to remind users to be vigilant against phishing attacks disguised as Zoom meeting links, in which attackers use the domain name "app[.]us4zoom[.]us" to impersonate a legitimate Zoom meeting link. The webpage is highly similar to the real Zoom meeting interface. When the user clicks the "Start Meeting" button, it triggers the download of a malicious installation package instead of starting the local Zoom client. Hackers collect user data and decrypt it to steal sensitive information, such as mnemonics and private keys. These attacks usually combine social engineering and Trojan technology. According to the analysis of the hacker address provided by a victim, the hacker address has made a profit of more than one million US dollars, including USD0++, MORPHO, ETH, etc., of which USD0++ and MORPHO were exchanged for 296 ETH.

#ETH