Elcheron Malware Targets Crypto Users on Telegram: Here’s How to Stay Safe

Cryptocurrency Hack Security Telegram

Author

Ruholamin Haqshanas

Author

Ruholamin Haqshanas

About Author

Ruholamin Haqshanas is a contributing crypto writer for CryptoNews. He is a crypto and finance journalist with over four years of experience. Ruholamin has been featured in several high-profile crypto...

Author Profile

Share

Copied

Last updated: 

October 22, 2023

Why Trust Cryptonews

Cryptonews has covered the cryptocurrency industry topics since 2017, aiming to provide informative insights to our readers. Our journalists and analysts have extensive experience in market analysis and blockchain technologies. We strive to maintain high editorial standards, focusing on factual accuracy and balanced reporting across all areas - from cryptocurrencies and blockchain projects to industry events, products, and technological developments. Our ongoing presence in the industry reflects our commitment to delivering relevant information in the evolving world of digital assets. Read more about Cryptonews

There is a new Telegram malware dubbed Elcheron, which joins crypto-focused groups in a bid to steal crypto wallets and account credentials, said SafeGuard Cyber.

According to the report, the malware is distributed among Telegram groups by a user with the “Smokes Night” handle, who spreads the malware by dropping an infected file into chat rooms without comment.

⚡️⚡️⚡️Attention, in the screenshot below is an example of an archive attachment with a preview, do not open if you will be sent to Telegram something like this (even from friends) ⚡️⚡️⚡️

As we can see, the attack with the Echelon was only a warming-up. pic.twitter.com/ABRFea1O3J

— Officer's Notes (@officer_cia) December 26, 2021

“The sample of Echelon that we analyzed targets credentials, crypto wallets, and has some fingerprinting capabilities,” SafeGuard detailed. This allows the attacker to gain access to victims’ crypto assets. 

However, the malware also attempts to gain access and steal credentials from multiple different messaging, File Transfer Protocol (FTP), and Virtual Private Network (VPN) platforms, which can be used for social engineering attacks in the future.

Nevertheless, users can apply some quick settings to improve security. 

In the first place, they need to disable automatic media download and activate other privacy settings like limiting certain options to contacts only. 

And, of course, they should never download unknown third-party files shared via any messaging or social media platform.

I'll tell you even more, the animated TG stickers were used to upload spread over Telegram, with the TG servers acting as proxies. It was enough to click on the animated sticker for remote code execution:)

So it's important to always keep this setting off.

— Officer's Notes (@officer_cia) December 25, 2021

Telegram, a cross-platform messaging app, has found popularity among the crypto community for its enhanced privacy and encryption features, its support for large groups, as well as the fact that it has no ties to Meta‘s family of social media apps — i.e., Facebook, Messenger, and Instagram. 

As reported, last week, investors of the Solana (SOL)-based non-fungible token (NFT) project Monkey Kingdom were robbed of their SOL tokens after a cyber thief hacked the project’s official Discord server and published a phishing link.

____

Learn more:
– Crypto Security in 2022: Prepare for More DeFi Hacks, Exchange Outages, and Noob Mistakes 
– Santa Hackathon? Visor Finance Marks 7th Hack in December

– Crypto Investment Trends in 2022: Brace for More Institutions and Meme Manias
– Half of Surveyed Millennial Millionaires Set to Buy Even More Bitcoin, Ethereum in 2022