Chinese investors fall victim to ether-stealing virus
Chinese investors are unwittingly downloading a virus that steals ether coins by opening a zip file that supposedly gives details about an initial coin offering white paper. Individual investors have lost up to CNY1m ($147,000) as the virus is able to bypass antivirus systems.

An ICO investor reported June 29 he fell victim to a scam in which he was led to believe a startup is doing an ICO project. Alex said he received a zip file with detailed information about the project and found his 80,000 yuan worth of ETH disappeared the next day.

The conman whose QQ number is 45295299 added Alex this Thursday claiming that he is working on an ICO project and wishes Alex to help check the whitepaper.

He said something nice about Alex and asked him to support his project. The criminal promised Alex that if everything worked out fine, he could get some kickback.

Alex took the bait. He received a zip file detailing everything he needs to know about the project.

When he was about to give some feedback on the whitepaper this morning, he was shocked to find that he lost 80,000 yuan worth of ETH.

The worst is yet to come. Alex searched the QQ number on Baidu and realized that the crook had been asking questions about how to bypass an antivirus on several hacker forums.

An antivirus works to detect viruses through two main ways, signature based detection and suspicious behavior. To cheat an antivirus, it involves a lot of encoding work. You can learn about about it at semantic:http://www.secmaniac.com/blog/2010/02/24/set-v0-4-1-rise-of-the-pink-pirate/

When Alex shared his story in an ICO group, he was surprised to hear that he was not the only victim. Some investors lost 180,000 yuan and some at least 1 million yuan. Now Alex has reported it to the police.

These victims all received an ICO file and the antivirus failed to detect some malware in it.

They read the whitepaper all night long in hopes of giving some useful advice and expected to get some rewards. But there is no such a thing called “Read my whitepaper, I’ll pay you.”

Tan Guopeng, founder of bitbill, said this morning that one of his colleagues lost all of his cryptocurrencies. He has been using imToken wallet and his assets were transferred last night without his knowledge. He is now talking with the company to see if there is any way to get his assets back.