Key Points
- Mehdi Farooq, an investment partner at Hypersphere, lost a significant portion of his life savings in a phishing attack via a fake Zoom call.
- The attack started with a hijacked Telegram account of a known contact, leading to a scheduled call that required a malicious Zoom update.
- Farooq's system was compromised, resulting in the draining of six wallets and complete laptop access by hackers.
- The attack was linked to a North Korea-affiliated threat actor known as “dangrouspassword.”
- Phishing attacks are becoming increasingly sophisticated, targeting crypto professionals with tactics like fake letters and malicious updates.
Summary
Mehdi Farooq, an investment partner at crypto venture capital firm Hypersphere, recently fell victim to a sophisticated phishing attack, losing a significant portion of his life savings. The scam began with a message on Telegram from a hijacked account of a known contact, Alex Lin, who scheduled a Zoom call via Farooq’s Calendly link. Minutes before the call, the scammer requested a switch to Zoom Business for “compliance reasons” and introduced a fake participant. During the call, Farooq was prompted to update Zoom due to audio issues, which led to his system being compromised. Hackers drained six of his wallets and gained full access to his laptop, all while the impersonator maintained casual conversation on Telegram. The attack, linked to a North Korea-affiliated threat actor “dangrouspassword,” highlights the growing sophistication of phishing scams targeting crypto professionals. This incident follows other recent breaches, including a $330 million Bitcoin theft and scams involving fake letters impersonating hardware wallet companies. Farooq’s experience serves as a stark reminder of the vulnerabilities in the crypto space, even for seasoned professionals, as attackers exploit trust and familiarity to execute devastating hacks.