Warning ❗️ An attack on thematic @telegram crypto chats ongoing now. The attackers use an account named "Smokes Night" to spread Echelon malware by dropping a file into the chat room.
TLDR: Disable auto-downloading in Telegram settings right now.
👇 See the thread below 👇
TLDR: Disable auto-downloading in Telegram settings right now.
👇 See the thread below 👇
@telegram 1/X
Here is a good article themed how to configure your TG, which don't have "out-of-the-box" privacy settings, correctly.
medium.com/immunefi/how-n…
Here is a good article themed how to configure your TG, which don't have "out-of-the-box" privacy settings, correctly.
medium.com/immunefi/how-n…
2/X
Original report: cisomag.eccouncil.org/echelon-malwar…
Full report: safeguardcyber.com/hubfs/Threat%2…
Original report: cisomag.eccouncil.org/echelon-malwar…
Full report: safeguardcyber.com/hubfs/Threat%2…
3/X
Looks like @github did not delete malware sources and it is still being sold at underground forums with using GitHub as a landing page.
1 - github.com/BitcoinFakeSen…
2 - github.com/swagkarna/Eche…
3 - postimg.cc/8FcSDzL6
Looks like @github did not delete malware sources and it is still being sold at underground forums with using GitHub as a landing page.
1 - github.com/BitcoinFakeSen…
2 - github.com/swagkarna/Eche…
3 - postimg.cc/8FcSDzL6
4/X
Actually this malware reminded me oldschool MaaS (Malware-as-a-Service) like cyberint.com/blog/research/…
Actually this malware reminded me oldschool MaaS (Malware-as-a-Service) like cyberint.com/blog/research/…
Solarwinds RTBM, PRTG Network Monitor should detect it as well as other bandwidth monitors.
5/X
This malware is operated via special Telegram bot. Unusual implementation of classic MaaS.
This malware is operated via special Telegram bot. Unusual implementation of classic MaaS.
7/X
Extended resources for those who want to avoid this malware:
- ledger.com/academy/securi…
- github.com/drduh/macOS-Se…
- github.com/jlopp/physical…
- usenix.org/system/files/1…
Extended resources for those who want to avoid this malware:
- ledger.com/academy/securi…
- github.com/drduh/macOS-Se…
- github.com/jlopp/physical…
- usenix.org/system/files/1…
9/X
Check out this convo (and my replies) as well, answered on questions here
TLDR: There are 2 ways of attack, 1st requires click from you, 2nd, which will cost the attacker more, not.
To protect from the 1st just stay accurate, from 2nd - keep auto downloading disabled.
Check out this convo (and my replies) as well, answered on questions here
TLDR: There are 2 ways of attack, 1st requires click from you, 2nd, which will cost the attacker more, not.
To protect from the 1st just stay accurate, from 2nd - keep auto downloading disabled.
https://twitter.com/wazzcrypto/status/1474788490206404615
10/10
In this convo I explained the attack (passive XSS) with using animated @telegram stickers, same as attackers did against @opensea users a month ago. Just to add on topic. Remember to keep “Loop Animated Stickers” setting off as well.
👇👇👇
In this convo I explained the attack (passive XSS) with using animated @telegram stickers, same as attackers did against @opensea users a month ago. Just to add on topic. Remember to keep “Loop Animated Stickers” setting off as well.
👇👇👇
https://twitter.com/officer_cia/status/1474737570282094592
See problem No20 github.com/OffcierCia/Cry…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
