These fake iOS apps just want to trick you out of your crypto
Researchers are warning of scammers stealing cryptocurrency
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
A known cryptocurrency fraud which leverages fake trading apps to trick people into giving away their hard-earned money made it pastApple’s strict security protocols and into its mobile app repository, researchers have warned.
Apple has been alerted to the presence and quickly moved to eliminate the threats from the App Store - still, if you have downloaded these apps, make sure to remove them from yourendpointsimmediately.
Cybersecurity researchers from Sophos have detailed two apps designed for so-called CryptoRom fraud. This type of fraud is quite simple - a trickster would create a fake social media account, assuming the identity of a rich, attractive woman. Then, they’d reach out to potential victims and after a little back-and-forth, trick them into downloading the fake trading apps, under the promise of riches and wealth.
Fake QR code scanners
People that would fall for the trick would think they’re making an investment, but would instead, just be parted with their money.
The two apps in question are called Ace Pro and MBM_BitScan, and what makes these two stand out from the crowd of other CryptoRom apps is the fact that they made it past Apple’s security and into the App Store.
One of the apps managed to bypass the protections by posing as a QR code scanner connected to a benign-looking website, but after a while, the developers redirected it to a domain registered in Asia, which ultimately delivers the fake trading interface.
Elon Musk isn’t giving you crypto - it’s a scam>Crypto scammers are fighting amongst themselves over stolen funds>Keep your identities safe with these best ID theft protection services
The other app, MBM_BitScan, is also available onGoogle’sPlay Store, where it’s known as BitScan. These two apps were observed communicating with the same Command and Control infrastructure (C2), which further communicates with a server posing as a legitimate Japanese crypto firm. Everything else is handled in the web interface, which is how the crooks managed to trick Google into allowing the app in the first place.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
The best way to protect against such scams, the researchers are saying, is to use common sense, and if something looks like a scam, it most likely is. If an app can’t be found on a legitimate repository, or requires extra steps to be used, that should raise a red flag with the users.
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Cisco issues patch to fix serious flaw allowing possible industrial systems takeover
Washington state court systems taken offline following cyberattack
I’ve used Genmoji and now I’m convinced Apple Intelligence will be a huge success
