- \n
- Fraudsters used Telegram Mini Apps to steal crypto.<\/li>\n
- Toronto uncovered the country\u2019s first SMS blaster.<\/li>\n
- Vulture hackers targeted the TeamPCP gang.<\/li>\n
- A tainted DAEMON Tools build was found in a hundred countries.<\/li>\n<\/ul>\n<\/div>\n
Fraudsters used Telegram Mini Apps to steal cryptocurrency<\/h2>\n
Cybersecurity researchers at CTM360<\/a> uncovered a Telegram-based fraud campaign used to steal crypto and spread malware.<\/p>\n
The criminals\u2019 platform, FEMITBOT, uses Telegram bots and embedded Mini Apps to create convincing in-app fakes across themes such as crypto, finance, AI tools and streaming.<\/p>\n
To build trust, the scammers impersonate well-known brands (Bitget, OKX, Binance, Apple, Coca-Cola, Disney, eBay, MoonPay, Nvidia) while reusing a single back-end across multiple domains and bots.<\/p>\n
Upon pressing \u201cStart\u201d, the bot launches a Mini App that renders a phishing page in an in-app WebView. The interface shows dashboards with bogus \u201cearnings\u201d figures, often paired with countdown timers or time-limited offers to stoke FOMO<\/span>.<\/p>\n
When users try to withdraw funds, they are told to make a test deposit or complete referral tasks\u2014a classic investment-fraud tactic.<\/p>\n
Some Mini Apps push malware as Android APKs, likewise disguised as household brands.<\/p>\n
![\"image\"](\"https:\/\/u1f987.com\/wp-content\/uploads\/img-076ab6c9590dee29-3869922154644926.webp\")
The FEMITBOT kit. Source: CTM360.<\/figcaption><\/figure>\n Researchers say the infrastructure is designed for easy reuse across campaigns. To analyse user activity and optimise the fraud, the operators employ Meta Pixel and TikTok Pixel tracking.<\/p>\n
Toronto uncovers Canada\u2019s first SMS blaster<\/h2>\n
Police arrested<\/a> three suspects for operating an SMS blaster in downtown Toronto.<\/p>\n
Such devices transmit a stronger signal than nearby cell towers, coercing handsets in range to connect to a fake base station.<\/p>\n
Once connected, they can broadcast texts that often contain links to phishing sites mimicking login pages of well-known companies.<\/p>\n
SMS blasters exploit weaknesses in legacy 2G networks and, beyond the direct threat, disrupt mobile service, including for emergency services.<\/p>\n
According to police, the goal was to steal usernames and passwords, including banking credentials.<\/p>\n
The campaign began in November 2025. Over several months, spam messages reached tens of thousands of devices. It is \u201cthe first known instance\u201d of such equipment operating in Canada.<\/p>\n
![\"image\"](\"https:\/\/u1f987.com\/wp-content\/uploads\/img-8f9f07059d4a6cd6-3869924240495657.webp\")
A similar device found in Bangkok. Source: Khaosod English<\/a>.<\/figcaption><\/figure>\n Authorities noted the rig\u2019s unusual build. Mounted in a car\u2019s rear compartment, it let the operators relocate quickly.<\/p>\n
In 2024, Thai police arrested<\/a> members of a gang using a similar setup. Hauled around Bangkok in a truck bed, it sent nearly a million messages in three days.<\/p>\n
Vulture hackers go after the TeamPCP gang<\/h2>\n
Unknown attackers are actively hunting for systems already compromised by the notorious TeamPCP<\/a> group, breaking in and locking them down. The campaign, dubbed PCPJack, was identified<\/a> by SentinelOne senior researcher Alex Delamotte.<\/p>\n
The intruders infiltrate the compromised infrastructure and remove backdoors to shut out the prior hackers, then deploy their own tooling, which propagates through cloud networks like a worm.<\/p>\n
PCPJack\u2019s tools automatically tally the servers wrested back from rivals.<\/p>\n
They steal credentials to resell access to other criminals or to extort victims themselves. Whereas most cloud intruders (including TeamPCP) plant cryptominers, PCPJack deliberately removes them. The group prefers to steal cryptocurrency directly, using dedicated routines to capture wallet passwords.<\/p>\n
According to the researcher, the operators do not limit themselves to systems already hit by TeamPCP. They also scan the internet for exposed services such as cloud virtual-machine platforms like Docker and the MongoDB database.<\/p>\n
In comments to TechCrunch<\/a>, Delamotte suggested the hackers could be disgruntled former TeamPCP members, a rival crew or mere copycats.<\/p>\n
Backdoored DAEMON Tools spotted in a hundred countries<\/h2>\n
Hackers implanted a trojan in the installer of DAEMON Tools Lite, a popular disk-imaging utility. Since April 8th they have used it to deploy backdoors on thousands of systems in more than 100 countries, researchers at \u201cKaspersky Lab<\/a>\u201d reported.<\/p>\n
After users installed the free version of DAEMON Tools, the malicious code dropped a payload to persist and to activate the backdoor on Windows startup.<\/p>\n
At the first stage, the attackers used a basic infostealer to collect system data and ship it to attacker-controlled servers for victim profiling. Based on those results, a second stage was initiated on some machines\u2014a backdoor capable of executing commands, downloading files and running code directly in memory.<\/p>\n
In some cases the QUIC RAT malware was used; it can inject code into standard processes and supports multiple communication protocols.<\/p>\n
Victims included retailers, academic, government and industrial organisations in Russia, Belarus and Thailand, as well as home PCs in Russia, Brazil, Turkey, Spain, Germany, France, Italy and China.<\/p>\n
DAEMON Tools developer Disc Soft continues<\/a> to investigate the incident. Users who downloaded DAEMON Tools Lite 12.5.1 after April 8th are advised to uninstall the app, run a full system scan and install the latest 12.6 version from the official site.<\/p>\n
Taiwan arrests student over high-speed rail hack<\/h2>\n
Taiwanese authorities detained a student suspected of hacking the TETRA<\/span> communications system used by the country\u2019s high-speed rail network (THSR), Newtalk<\/a> reported.<\/p>\n
THSR is a 350 km double-track line along Taiwan\u2019s west coast, with trains reaching 300 km\/h.<\/p>\n
On April 5th, a citizen surnamed Lin halted four trains for 48 minutes using a SDR<\/span> and handheld radios to transmit a high-priority \u201cGeneral Alarm\u201d signal, triggering emergency braking.<\/p>\n
![\"train\"](\"https:\/\/u1f987.com\/wp-content\/uploads\/img-91c9f27441d05e50-3870198859744851.webp\")
THSR train. Source: Unsplash\/Kaden Taylor<\/a>.<\/figcaption><\/figure>\n Before the attack, Lin intercepted and decoded radio parameters using equipment bought on a marketplace. He then programmed the captured data into handheld radios to transmit signals that mimicked official radio beacons.<\/p>\n
According to police, an accomplice helped Lin configure the setup. THSR had been in operation for 19 years and its parameters apparently had not changed<\/a>, allowing the hacker to bypass seven verification layers.<\/p>\n
After the incident, THSR specialists examined logs and found the signal had been sent from a beacon that was not assigned to duty. The company concluded the signal had been cloned without authorisation.<\/p>\n
Investigators reviewed CCTV and TETRA network server records, leading them to the suspect\u2019s residence. A search found and seized 11 handheld radios, one SDR device and a laptop.<\/p>\n
![\"image\"](\"https:\/\/u1f987.com\/wp-content\/uploads\/img-5419aae778de16a6-3869923757057049.webp\")
Source: UDN<\/a>.<\/figcaption><\/figure>\n Lin faces up to ten years in prison. His lawyer claims the alarm transmission was accidental, but authorities find the explanation unconvincing.<\/p>\n
Also on ForkLog:<\/p>\n
- \n
- Aave liquidated<\/a> the Kelp hacker\u2019s positions.<\/li>\n
- Market maker TrustedVolumes was hacked<\/a> for $6 million.<\/li>\n
- Bitcoin Core developers fixed<\/a> a critical vulnerability.<\/li>\n
- Lawyers for DPRK victims reclassified<\/a> the Kelp hack as credit fraud.<\/li>\n
- A hacker stole<\/a> $1.4 million via a vulnerability in Ekubo\u2019s contract.<\/li>\n
- North Korea called<\/a> allegations of hacking crypto projects \u201cabsurd slander\u201d.<\/li>\n<\/ul>\n
What to read at the weekend?<\/h2>\n
ForkLog unpacks what really happened to the InfoFi segment\u2014and how it might return.<\/p>\n","protected":false},"excerpt":{"rendered":"
A roundup of the week\u2019s most important cybersecurity news.<\/p>\n","protected":false},"author":1,"featured_media":96957,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"The week\u2019s key cyber stories: Telegram scams, SMS blaster, TeamPCP, DAEMON Tools trojan.","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1238,1233],"class_list":["post-96956","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-cybersecurity-digest","tag-industry-digests"],"aioseo_notices":[],"amp_enabled":true,"views":"22","promo_type":"1","layout_type":"1","short_excerpt":"The week\u2019s key cyber stories: Telegram scams, SMS blaster, TeamPCP, DAEMON Tools trojan.","is_update":"","_links":{"self":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/96956","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/comments?post=96956"}],"version-history":[{"count":1,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/96956\/revisions"}],"predecessor-version":[{"id":96958,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/96956\/revisions\/96958"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media\/96957"}],"wp:attachment":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media?parent=96956"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/categories?post=96956"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/tags?post=96956"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- Market maker TrustedVolumes was hacked<\/a> for $6 million.<\/li>\n
- Aave liquidated<\/a> the Kelp hacker\u2019s positions.<\/li>\n