Hundreds of Android and iOS investment and cryptocurrency apps are scams

On Wednesday, Sophos researchers announced who discovered a server with hundreds of investment and cryptocurrency apps that actually aim to scam users, both for Android and iOS. It is worth mentioning that, to circumvent the App Store's thorough inspection, these apps use third-party services to use a process called Super Signature, used by developers to test their apps, and thus, manage to install malicious programs on iPhones, which are more secure than Android devices.

The current wave of interest in day trading e cryptocurrencies is being used by hackers to extort money from unsuspecting users. Criminals are creating fake apps that look like well-known, legitimate apps like Barclays, Gemini, Kraken, TDBank, and Binance. Hackers are also creating websites for each app that look like those of these investment companies, thus increasing the chances of victims downloading the scam apps.

How the scam was discovered

Sophos' investigation began with a complaint from a victim who was approached by a social media and dating site and tricked into downloading a fake scam app from Asian investment company Goldenway Group.

In these cases, hackers are taking a more personal approach, pretending to be a friend or a potential relationship seeker to gain the victim’s trust. After a while, the criminals mention a great investment opportunity and point them to an app or website. After the victim is tricked into opening an investment account or cryptocurrency wallet and depositing their money, the hackers seize the funds and block the person on social media.

This network of fake investment apps appears to be primarily targeting Asia. Sophos researchers discovered folders on the malicious apps’ servers containing identity documents, driver’s licenses and passport photos of people from South Korea, China, Malaysia and Japan.

“We believe these documents are used to legitimize financial transactions, such as confirming victims’ deposits,” the researchers wrote. “We also found several profile photos of attractive people, likely used to create fake profiles on dating apps and websites, suggesting that criminals may be using interest in relationships as bait to lure victims.”

Through which channels you reach those people, classic and out of the box. ZDNet

Image: Markus Spiske (Unsplash)