Thomas Roberts - Anatomy of a Crypto Scam

[giscus[bot]]

Thomas Roberts - Anatomy of a Crypto Scam

Thomas Roberts is a fraudulent YouTuber who uses fake crypto tutorials to spread malware. He artificially inflates his channel's popularity and promotes a malicious script that downloads harmful files and steals crypto. This scam, powered by AI-generated content, highlights the growing sophistication of online threats.

https://www.maxpou.fr/blog/crypto-scam-with-ai/

[Warciate]

hello thanks for this brilliant post, I fell in the trap what to do now ? is it that bad or ?

[maxpou]

Hi @Warciate, thanks for the kind words.

Yes, it's bad.
According to the "Hidden Script", here are a few things you can do:

• Scan your computer with an antivirus;
• Remove the registry entry that automatically starts client32.exe. You can do this by searching for "regedit" in the Start menu, navigating to HKCU:\Software\Microsoft\Windows\CurrentVersion\Run, and deleting the "NsSupport" value;
• Consider changing your passwords.

If you're not comfortable with 1&2, you should consider doing a hard reset + reinstall windows.

Good luck.

PS: btw, have you lost something?

[Warciate]

nono I mean its my school laptop so i dt have anything to protect on this computer except password like gmail etc but nothing with crypto or money

fuck this, that was sophisticated

[M4SQUER4ID]

Nice article, thanks (you've an "unintended" typo @step 2 - should be unindented)

Ran this on a sandbox and it looks like cleanup just needs removal of the registry key and deletion of the %appdata%\Ns folder (provided you've not restarted or have one of the targeted wallets!)

No idea what the exe in the \Ns folder is up to ... yet!

[maxpou]

Thanks! I just corrected the typo :)