Sophos, a global leader in next-generation cyber security, has identified a stash of 167 counterfeit Android and iOS apps that attackers are using to steal money from people who believe they have installed a financial trading, banking or crypto-currency app from a well-known and trusted organisation. A report on the findings: “Fake Android and iOS apps disguised as trading and cryptocurrency apps”, shows how the attackers used social engineering techniques, counterfeit Web sites, including a fake iOS App Store download page, and an iOS app-testing Web site, to distribute the fake apps to unsuspecting users.
Sophos researchers investigated the fake apps and found that many were very similar. Some included an embedded customer support “chat” option. When researchers tried to communicate with the support teams using the chat, the replies they received used near-identical language. The researchers also uncovered a single server loaded with 167 fake trading and crypto-currency apps. Taken together, this suggests that the scams could all be operated by the same group, according to Sophos.
In one of the schemes investigated, the scammers befriended users via a dating app, setting up a profile and exchanging messages with individual targets before attempting to lure them into installing and adding money and crypto-currency to a fake app. If targets later tried to withdraw funds or close the account, the attackers simply blocked their access.
In other cases, targets were caught through Web sites designed to resemble that of a trusted brand, such as a bank. The operators even set up a fake “iOS App Store” download page featuring fake customer reviews in order to convince targets they were installing an app from the genuine App Store.
If people clicked on the links to download the fake apps for either Android or iOS, they received something that looked like a mobile Web app, but was in fact a short-cut icon that linked to a fake Web site.
The operators also distributed some of the fake iOS apps via third-party Web sites that help iOS developers test new applications with a limited number of Apple device users before they submit apps to the official App Store.
“People trust the brands and people they know – or think they know – and the operators behind these fake trading and crypto-currency scams ruthlessly take advantage of that,” said Jagadeesh Chandraiah, senior threat researcher at Sophos. “The fake applications we uncovered impersonate popular and trusted financial apps from all over the world, while the dating site sting begins with a friendly exchange of messages to build trust before the target is asked to install a fake app. Such tactics make the fraud seem very believable.
“To avoid falling prey to such malicious apps, users should only install apps from trusted sources such as Google Play and Apple’s App Store. Developers of popular apps often have a Web site, which directs users to the genuine app and, if they have the skills to do so, users should verify if the app they are about to install was created by its actual developer. Last, but not least, if something seems risky or too good to be true – high returns on investment or someone from a dating site asking you to transfer money or crypto-currency assets into some ‘great’ account – then sadly, it probably is.”
Sophos detects these apps as Andr/FakeApp-DC, iPh/FakeApp-DD and iPh/FakeApp-DE.
Sophos also advises users to install an anti-virus app on their mobile device, such as Intercept X for Mobile, to protect Android and iOS devices from cyber threats.
Further information on the Android and iOS fake trading and crypto-currency apps and other mobile threats reported on by Sophos is available at SophosLabs Uncut.
Share
Sophos
Sophos is a worldwide leader in next-generation cybersecurity, protecting more than 500,000 organizations and millions of consumers in more than 150 countries from today’s most advanced cyberthreats. Powered by threat intelligence, AI and machine learning from SophosLabs and SophosAI, Sophos delivers a broad portfolio of advanced products and services to secure users, networks and endpoints against ransomware, malware, exploits, phishing and the wide range of other cyberattacks. Sophos provides a single integrated cloud-based management console, Sophos Central – the centerpiece of an adaptive cybersecurity ecosystem that features a centralized data lake that leverages a rich set of open APIs available to customers, partners, developers, and other cybersecurity vendors. Sophos sells its products and services through reseller partners and managed service providers (MSPs) worldwide. Sophos is headquartered in Oxford, U.K. More information is available at www.sophos.com.