Back Cybersecuritynews

Fake Screenshot Lures Used to Infect Web3 Support Staff With Multi

Cybersecuritynews •Tushar Subhra Dutta • March 26, 2026

A threat group known as APT-Q-27 has been running an active campaign against Web3 customer support teams, using fake screenshot links in live chat windows to silently install a persistent backdoor on victim machines. The attack targets the most human part of any organization — the support agent answering tickets — rather than exploiting software […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

APT-Q-27 Targets Web3 Support Staff with Fake Screenshot Backdoor Campaign A campaign linked to the Chinese threat group APT-Q-27 is targeting Web3 customer support teams by deploying a multi-stage backdoor via fake screenshot links. The attack exploits live chat workflows, utilizing signed .NET loaders and AWS S3 dead drops to deliver a memory-resident Farfli backdoor. This operation focuses on support agents, the human element of organizations, to gain access to sensitive systems. The specific tools and methods employed indicate a sophisticated approach to compromise victim machines without detection. The current status of the campaign suggests ongoing activity, with potential impacts on multiple organizations within the Web3 sector. The attack emphasizes the need for heightened vigilance among support teams in the cryptocurrency space. 2 sources 73

Extracted Entities

Fake Screenshot Lures Used to Infect Web3 Support Staff With Multi

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

MITRE ATT&CK (1)