Back Gbhackers

Fake Screenshot Lures Target Web3 Support Staff with Multi

Gbhackers •Mayura Kathir • March 26, 2026

Fake screenshot links are being used to quietly deploy a multi‑stage backdoor against Web3 customer support teams, in a campaign assessed to be linked to the Chinese financially motivated group APT‑Q‑27 (GoldenEyeDog). The operation abuses live chat workflows, signed .NET loaders, AWS S3 dead drops, and DLL sideloading to land a memory‑resident Farfli backdoor that […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

APT-Q-27 Targets Web3 Support Staff with Fake Screenshot Backdoor Campaign A campaign linked to the Chinese threat group APT-Q-27 is targeting Web3 customer support teams by deploying a multi-stage backdoor via fake screenshot links. The attack exploits live chat workflows, utilizing signed .NET loaders and AWS S3 dead drops to deliver a memory-resident Farfli backdoor. This operation focuses on support agents, the human element of organizations, to gain access to sensitive systems. The specific tools and methods employed indicate a sophisticated approach to compromise victim machines without detection. The current status of the campaign suggests ongoing activity, with potential impacts on multiple organizations within the Web3 sector. The attack emphasizes the need for heightened vigilance among support teams in the cryptocurrency space. 2 sources 73

Extracted Entities

Fake Screenshot Lures Target Web3 Support Staff with Multi

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Companies (1)

Malware (1)

MITRE ATT&CK (1)