Crypto Wallet Hacking through Telegram

[rhomelmabini]

I think this is somewhat similar to the discord malware that was announced for a warning from one of the developer server that I'm into. Can't remember it clearly but it does the same as a "loading image" as they put it. I think to combat this is really having 2FA on all accounts especially if it contains money or important informations. These scammers and hackers are really that adept.

[1715143773]

1715143773

[1715143773]

1715143773

[1715143773]

1715143773

[1715143773]

1715143773

[blockman]

I think this is somewhat similar to the discord malware that was announced for a warning from one of the developer server that I'm into. Can't remember it clearly but it does the same as a "loading image" as they put it. I think to combat this is really having 2FA on all accounts especially if it contains money or important informations. These scammers and hackers are really that adept.

2FA is really needed for our wallets and activate it as always. And to counter this possible threat for everyone using telegram, we can just simply turn off the automatic download.
Good thing that I've read this thread and read the replies of others of turning off the automatic download of file which includes the videos, images and other file types.

[Oceat]

I think this is somewhat similar to the discord malware that was announced for a warning from one of the developer server that I'm into. Can't remember it clearly but it does the same as a "loading image" as they put it. I think to combat this is really having 2FA on all accounts especially if it contains money or important informations. These scammers and hackers are really that adept.

2FA is really needed for our wallets and activate it as always. And to counter this possible threat for everyone using telegram, we can just simply turn off the automatic download.
Good thing that I've read this thread and read the replies of others of turning off the automatic download of file which includes the videos, images and other file types.

Luckily, I don't have telegram for now since I am done using it in the past so I just uninstalled it and probably it has already been updated to disable that "auto download" part. Scammers nowadays are really trying their best to get their hands onto your wallet to steal in the process. What app would they be going to manipulate next?

I think 2FA is the best option here but I don't know something is really odd with these scammer/hacker nowadays. Makes you feel less secured if you have more apps in your computer and I don't think AV would be able to detect that.

[vv181]

i do believe that the default setting of telegram should be to disable the auto download. I hope telegram may explorer this option in their later releases.

I think one of the few reasons they enable the default auto-download settings is to make user experiences more intuitive, so the user won't have to manually click the media to show what it is. Aside from the UX settings, specifically about security, I do think it is approachable to let the user particularly choose how the auto-download feature behave on the first run, not just straightly enable it. So yea, Telegram should address this issue from their side.

~I think to combat this is really having 2FA on all accounts especially if it contains money or important informations. These scammers and hackers are really that adept.

According to the malware report, they are also stealing wallets data instead of only credentials. So in addition of activating 2FA, anyone should really take into consideration of how they store and use any cryptocurrencies wallets.

[hosseinimr93]

To those who are recommending 2FA for securing their fund:

Bitcoin purpose is to have full control over your money. Note that with using a custodial wallet with 2FA feature, you actually give the control of your money to the service provider.
You may decrease the chance of getting hacked (if you have the 2FA application in a separate device), but you are in the danger of being scammed.

[coupable]

I think this is somewhat similar to the discord malware that was announced for a warning from one of the developer server that I'm into. Can't remember it clearly but it does the same as a "loading image" as they put it. I think to combat this is really having 2FA on all accounts especially if it contains money or important informations. These scammers and hackers are really that adept.

2FA is really needed for our wallets and activate it as always. And to counter this possible threat for everyone using telegram, we can just simply turn off the automatic download.
Good thing that I've read this thread and read the replies of others of turning off the automatic download of file which includes the videos, images and other file types.

The 2FA won't help in this case because the malware will start taking screeshots from your screen without you get a notice about this then send them to the hacker(s). The possibility that he took a screenshot for the file where you store your private codes is quite high. So if he can get your seed for instence he won't be in need for additional security steps. Note also that Non-Custudial wallets doesn't run with an additional security measure because it's not controlled by any entity and the data are encrypted within the device itself.

Thank you OP for pointing out the issue. I am sure many users use Telegram without even knowing that media files are downloadable by default in the app settings .

[adzino]

Recently i was reading an article where Hackers target crypto wallets through Telegram using Echelon malware is explained.
I have followed the instructions and disabled the Automatic download of media option in telegram. But i fear that many people will keep the auto download option enable because of unaware of this threat.
I wonder how this virus will work and how can they reach to our wallets / exchanges?

This whole Telegram is filled with bunch of hackers and scammers. But I doubt a "virus" can be spread automatically without having to do anything. Like another user mentioned, it's a rar file. So the user has to extract the file to infect his/her phone. So even if auto download is turned on, it's not possible to mess up your phone unless you carelessly open a random file. It also has a .exe file, so your phone can't even run it. You will have to send it to your computer and then run it. So unless you are a dimwit, I guess they can't "automatically" hack your wallet through telegram.

[yazher]

That's scary because most users have the default setting of downloading any files on their telegram group automatically. By disabling those setting will help a lot. That's why I keep ignoring everything when something pops out every time I browsed the internet because of such kinds of malicious files. anyway, installing Adblock on browsers will help a lot, you just need to download it from their official website.

[DapanasFruit]

I am always alarmed whenever I heard that a common program like Telegram can be used to victimized people out of the digital assets they are holding. As someone who had been one of the many in the victim statistics, I dread the feeling of being a helpless victim and i will never allow to undergo the same kind of experience again. Now, to a very non-techie person like me, just open your Telegram account then look for Settings and from there look for Data and Storage and you can see Automatic media download...make sure that you click the three buttons off. That's it...better be safe than sorry, guys!

[Leviathan.007]

This can be new when you consider this situation in cryptocurrencies but that's nothing new to me and many other people, the hackers, and scammers can easily bind the malware in some media which can be a picture or a video. So whenever you open the media and download it, this will be executed on your phone or your computer and usually no anti-malware can detect it easily. This malware can stay running on your devices and monitor whatever you do anonymously and then send your personal information to the hacker, or this malware can collect your saved passwords keys and send all of the information. in order to stay safe from this malware you can turn off the auto-download in telegram also have some tools to monitor your network status and device's active connections.

[pealr12]

I think the best bet is to avoid downloading anything from Telegram, I also saw the warning post in one Telegram channel and I have disabled all auto download but I will still apply additional caution and avoid manually downloading anything from Telegram, aside from too many scammers already crawling in that platform now hackers want to create more havoc! unbelievable.  

[BitcoinAccepted]

I think the best bet is to avoid downloading anything from Telegram, I also saw the warning post in one Telegram channel and I have disabled all auto download but I will still apply additional caution and avoid manually downloading anything from Telegram, aside from too many scammers already crawling in that platform now hackers want to create more havoc! unbelievable.  

Indeed. Having a layer of software for security protection is a good thing, but being cautious is another best thing to do to prevent such. Scammers will try and improvise their schemes so that they could push through their intentions, they are getting smarter day by day in making ways to proceed such deeds, so we must be one step ahead of them in protecting ourselves and assets.

[Alanaz]

Of course this should get more attention because it is very disturbing and makes almost everyone anxious and including myself.
this becomes very uncontrollable because indeed things like this sometimes in my own telegram always activate automatic downloads.
I feel this is something very dangerous threat.
one possible alternative at the moment is maybe having to disable the auto feature to narrow this down

[RichardM]

Recently i was reading an article where Hackers target crypto wallets through Telegram using Echelon malware is explained.
I have followed the instructions and disabled the Automatic download of media option in telegram. But i fear that many people will keep the auto download option enable because of unaware of this threat.
I wonder how this virus will work and how can they reach to our wallets / exchanges?

A recent study reveals that hackers can hack crypto wallets through Telegram. Hackers use the public keys of the victim’s wallet, and once they get it, they can send crypto coins to their own wallet.

[pawanjain]

Recently i was reading an article where Hackers target crypto wallets through Telegram using Echelon malware is explained.
I have followed the instructions and disabled the Automatic download of media option in telegram. But i fear that many people will keep the auto download option enable because of unaware of this threat.
I wonder how this virus will work and how can they reach to our wallets / exchanges?

That's actually a good tip for everyone to follow not only on telegram but also on other messaging apps.
I always have the habit of disabling the auto media download and hence I am on the safer side anyway but as safety measure I cross checked this on all the messaging apps.
Downloading a file with malware automatically puts our device on risk. No wonder hackers could use this functionality for their benefits.
Thanks for posting this thread as it creates a good awareness among all the people reading it.

[wayne_kenoff]

Hackers use malware files for attack device. They creta malwares and share on Telegram and when anyone download it then hacker got all information about device and then he control device easily and hack wallets and personal information.

The method is actually very easy and it only takes few seconds to carry out. The hacker will send a message with a fake URL to the victim and once they click on this link, the hacker gets access to their wallet and steals all of their funds. This could be very dangerous for anyone who handles large sums of money in cryptocurrency wallets.

[Lanatsa]

The auto download feature should probably be disabled for safety per se, and thus allow the user for a more granular and attention based approach. Since the file is a .rar, and then you require executing the enclosed .exe, I don’t believe that happens on its own as an automatic corollary to the download process. Rather more, I figure, It should be the user that initiates this latter procedure, although the OP’s article does argue for the whole sequence to be automatic, which I find odd:

If this one is on auto download mode then its just right that Telegram would do something about this? Most of the time or basing up on experience on where executing downloads should really require that

command or action for a user to make before it do executes which I do also find odd if ever it was on auto download on that case.This is why im really hesitant on making out app downloads on my
phone or even on my desktop and then hearing this one out makes me check out my TG. lol

Hacking do becomes more and more enhanced and cant really be detected out.These hackers/scammers are getting wiser each day.

[DaveF]

There are things missing form this story.

1) It's an old piece of malware and every AV should detect it.
2) As others have said, it's a windows EXE so it should not matter to mobile

So there is something else going on.

The other issue is with phones there are soooooo many cheap android phones that have some form of backdoors installed. And with iPhones there are so many people with old un-updated / un-patched ones that still have vulnerabilities that have been fixed for months, if not years at this point.

So can things spread through telegram, yeah probably, but if you are up to date, running AV and are not using a $40 knock off phone, it's a lot harder.

-Dave

[davis196]

Why does Telegram have an auto-download feature?What's the point of downloading files without the user's permission?
I remember that Telegram was being praised as the texting/social app,where you have complete privacy and your text messages are encrypted.This claim was proven wrong and Telegram messages aren't that encrypted and safe.Telegram is nothing but a slightly better alternative to Skype,if you ask me.
I've had a Telegram account,but I deleted that account.It seems to me that apps like Discord and Slack are better than Telegram.However,crypto scams and malware can be found on every texting/social media app.

[kryptqnick]

I heard of it and got a bit scared, but then I remembered that my solution is following exactly zero crypto-related channels in Telegram. Still, I was surprised by the news, as somehow I didn't think about the way messengers download media immediately as being a security risk. Still, though, after reading this thread, I decided to go ahead and stop the auto-download feature right now because it's a simple yet life-saving solution to this problem. Should have done it a long time ago anyway because, to be honest, it's annoying on its own, even without the malware threat. It would have been better if they made it turned off by default, though, given the malware spread.