A known cryptocurrency fraud which leverages fake trading apps to trick people into giving away their hard-earned money made it past Apple’s strict security protocols and into its mobile app repository, researchers have warned.
Apple has been alerted to the presence and quickly moved to eliminate the threats from the App Store – still, if you have downloaded these apps, make sure to remove them from your endpoints (opens in new tab) immediately.
Cybersecurity researchers from Sophos have detailed two apps designed for so-called CryptoRom fraud. This type of fraud is quite simple – a trickster would create a fake social media account, assuming the identity of a rich, attractive woman. Then, they’d reach out to potential victims and after a little back-and-forth, trick them into downloading the fake trading apps, under the promise of riches and wealth.
Fake QR code scanners
People that would fall for the trick would think they’re making an investment, but would instead, just be parted with their money.
The two apps in question are called Ace Pro and MBM_BitScan, and what makes these two stand out from the crowd of other CryptoRom apps is the fact that they made it past Apple’s security and into the App Store.
One of the apps managed to bypass the protections by posing as a QR code scanner connected to a benign-looking website, but after a while, the developers redirected it to a domain registered in Asia, which ultimately delivers the fake trading interface.
The other app, MBM_BitScan, is also available on Google’s Play Store, where it’s known as BitScan. These two apps were observed communicating with the same Command and Control infrastructure (C2), which further communicates with a server posing as a legitimate Japanese crypto firm. Everything else is handled in the web interface, which is how the crooks managed to trick Google into allowing the app in the first place.
The best way to protect against such scams, the researchers are saying, is to use common sense, and if something looks like a scam, it most likely is. If an app can’t be found on a legitimate repository, or requires extra steps to be used, that should raise a red flag with the users.
