The CEO of Emblem Vault, Jake Gallen, has raised alarms about a sophisticated scam known as ‘Elusive Comet’ after losing over $100,000 in digital assets. This incident highlights the vulnerabilities in video conferencing platforms like Zoom, which can be exploited by cybercriminals to gain unauthorized access to users' crypto wallets.
Key Takeaways
-
Jake Gallen lost 75% of his assets due to a scam linked to a Zoom call.
-
The scam involved social engineering tactics to install malware on his computer.
-
Users are advised to disable remote access features on Zoom to prevent similar attacks.
The Incident
On April 11, Gallen reported a complete compromise of his computer, leading to the theft of significant amounts of Bitcoin (BTC) and Ether (ETH) from various wallets. He described the incident as a devastating loss, stating, "Unfortunately, this led to $100k+ in purchased digital assets being lost".
Following the incident, Gallen collaborated with cybersecurity firm The Security Alliance (SEAL) to investigate the ongoing threat posed by the malicious actor known as ‘Elusive Comet.’ This actor is believed to have orchestrated a series of attacks targeting crypto users through deceptive tactics.
How The Scam Worked
Gallen detailed how he was lured into the scam during a Zoom interview with an individual claiming to be the CEO of a crypto mining platform. The attacker, who kept their video off during the call, tricked Gallen into enabling the installation of malware named “GOOPDATE”. This malware was designed to steal credentials and access his crypto wallets.
-
Key Steps in the Scam:
-
Gallen received a message from a verified account on X (formerly Twitter) claiming to be a legitimate crypto executive.
-
During the Zoom call, the attacker requested remote access to Gallen's computer.
-
Gallen unknowingly granted access, allowing the installation of the malware.
-
The malware then compromised his crypto wallets, leading to significant asset loss.
-
Security Implications
The incident has raised serious concerns about the security settings of video conferencing tools like Zoom. Gallen pointed out that the default settings allow participants to request remote control access, which can be exploited by malicious actors. Leonidas, a fellow NFT collector, confirmed this vulnerability, urging users to disable remote access features to protect their systems.
-
Recommendations for Users:
-
Disable remote access features on Zoom.
-
Be cautious of unsolicited requests for remote access during video calls.
-
Regularly update security software and conduct malware scans.
-
Use two-factor authentication for crypto wallets and accounts.
-
The Bigger Picture
SEAL's cybersecurity researcher, Samczsun, noted that while the victim must still be social engineered into granting access, the default settings on Zoom pose a significant risk. The ‘Elusive Comet’ threat actor is linked to Aureon Capital, a purported venture capital firm, and is responsible for millions of dollars in stolen funds. Users who have interacted with Aureon Capital are advised to reach out to SEAL for assistance.
This incident serves as a stark reminder of the importance of cybersecurity awareness, especially in the rapidly evolving world of cryptocurrency. As scams become more sophisticated, users must remain vigilant and informed to protect their digital assets.
Sources
This article was created with support from AI-driven technology, drawing on multiple reputable sources. The final content has been thoroughly reviewed and edited by BlockzHub's editorial team to ensure accuracy, clarity, and coherence. Original reporting sources are credited whenever appropriate and as required. The opinions expressed in this article do not necessarily represent the official views or positions of BlockzHub. This article is intended for informational purposes only and should not be considered financial or professional advice. Investing involves risk, and you should consult a qualified financial advisor before making any investment decisions.