Chinese authorities have issued a warning about a fraud scheme involving the fake “DeepSeek cryptocurrency project,” in which criminals raised funds under their own name before disappearing. In addition, scammers promoted “DeepSeekCoin” on fake official groups, leading to financial losses for investors.
The National Computer Virus Emergency Response Center and the National Engineering Laboratory for Computer Virus Prevention and Control Technology also uncovered a sophisticated cyberattack linked to the scam. Using the National Computer Virus Joint Analysis Platform, authorities detected an Android Trojan virus that imitates the official DeepSeek app, posing a significant threat to users' personal data and financial security.
According to the Chinese government, the fake DeepSeek app prompts users to install a fake update when launched. This update tricks users into granting background and accessibility service permissions by installing a subpackage containing malicious code. Once active, the Trojan virus can:
- Blocking text messages
- Steal contacts and app lists
- Prevent users from uninstalling malicious apps
Authorities warn that this Trojan is a new variant designed specifically for financial theft. Cybercriminals are actively distributing it through unofficial channels, putting users' privacy and economic interests at risk.
Further investigations revealed multiple malicious files named DeepSeek.exe, DeepSeek.msi, and DeepSeek.dmg, indicating that the virus is not limited to Android devices. The findings suggest that hackers are using the DeepSeek name as a disguise to spread their Trojan programs across various platforms.
*This is not investment advice.
