Hackers Use Zoom to Steal Crypto: How Elusive Comet Tricks Victims in Fake Interviews

A cyber group known as Elusive Comet is using a new kind of social engineering attack that takes advantage of Zoom’s remote control feature. Their goal? To steal cryptocurrency from unsuspecting victims by tricking them during fake online interviews.

This new attack method was uncovered by cybersecurity experts at Trail of Bits, who warn that even experienced users can fall for the scam due to how well it mimics legitimate Zoom behavior.

How the Zoom-Based Crypto Scam Works

The attackers begin by impersonating journalists from well-known media outlets like Bloomberg. They reach out to potential victims—usually people who work in the cryptocurrency industry—through social media platforms like X (formerly Twitter) or email.

Victims are invited to a Zoom interview under the pretense of being featured in a high-profile media segment. These invitations are sent through legitimate tools like Calendly and Zoom, which helps the attackers appear trustworthy and professional.

Once the victim joins the Zoom call, the attackers share their screen and then send a remote control request. But here’s the clever trick—they rename their Zoom display name to “Zoom” itself. So when the victim sees the request, it looks like a legitimate system prompt that says:
“Zoom is requesting remote control of your screen.”

This simple trick is enough to fool many users into clicking “Approve” without realizing that they’re granting full access to a hacker.

What Happens After Access is Granted

Once the hacker gains remote control, they can do a number of dangerous things, including:

• Stealing cryptocurrency wallet credentials

• Accessing sensitive files or documents

• Installing malware or backdoors

• Making unauthorized crypto transactions

According to Trail of Bits, the attackers move quickly. They may even install hidden backdoors so they can return later without being detected, even after the Zoom call ends.

This method is particularly dangerous because it doesn’t rely on software vulnerabilities or complex malware. Instead, it manipulates human behavior and the trust we place in common tools like Zoom.

Ties to the $1.5 Billion Bybit Crypto Hack

Trail of Bits also noted that the tactics used by Elusive Comet are similar to those used in the massive Bybit crypto hack in February, where attackers stole $1.5 billion. In both cases, the hackers didn’t rely on technical vulnerabilities but rather exploited trust and standard workflows.

By copying methods seen in earlier high-profile attacks, Elusive Comet shows how effective social engineering can be—especially when the attack feels familiar and routine.

Why Users Are Falling for It

One reason this scam is so effective is the way Zoom’s interface handles permissions. Users are often asked to approve things during regular Zoom calls, such as allowing screen sharing or enabling audio. Over time, users get used to clicking “Approve” without thinking twice.

Trail of Bits highlights this issue, warning that users may grant dangerous permissions simply out of habit—especially when the request looks like it’s coming directly from the Zoom app.