Sophos exposes 167 fake cryptocurrency and trading apps used by hackers to steal money

• Scammers are leveraging fake apps to steal money in the name of cryptocurrencies.
• Sophos Group has identified 167 counterfeit Android and iOS apps used by attackers to steal money.
• The fake apps were immaculately designed to mimic Barclays, Binance, Gemini, Kraken, and more.
• After the victim installs the application, the researcher said that the scammers would convince the victims about investing in cryptocurrencies.

British cybersecurity company Sophos Group has identified 167 counterfeit Android and iOS apps used by attackers to steal money from people who believe they have installed financial trading, banking, or cryptocurrency apps from a trusted organization.

After the victim installs the application, the researcher said that the scammers would convince the victims about investing in cryptocurrencies. Jagadeesh Chandraiah, a senior threat researcher at Sophos, said that this modus operandi was "driven by the recent significant rise in the value of cryptocurrencies and interest in low-cost or free stock trading."

For example, researchers identified an instance in which an attacker found a victim on a dating app and eventually manipulated him into installing a fake app. Once the fake app was installed, users would mention their existing account details, allowing the scammers to steal money from the real account.

In another instance, the scammers created a fake version of the App Store download page. A user assumes it to be a safe and trusted page and proceeds to enter their Apple ID credentials. Now they stand compromised. This method of attack is called phishing.

With the boom in cryptocurrencies, there is a higher chance of users getting carried away with lucrative deals, offers, or promises. And, technology has enabled real-time trading from our mobile phones, making it a perfect point of contact for an attack. The fake apps were immaculately designed to mimic Barclays, Binance, Gemini, Kraken, TDBank, BitcoinHK, Bittrex, and BitFlyer.

Binance and Kraken are among the top cryptocurrency exchanges globally and have a higher brand recognition when one's discussing cryptocurrency, in particular. "People trust the brands and people they know – or think they know – and the operators behind these fake trading and cryptocurrency scams ruthlessly take advantage of that," Chandraiah added.

What's worse is, these apps had a legitimate customer support function that helped users transfer their money to banks in Hong Kong. The security firm is confident that these apps are a part of a single extensive operation. Servers accessed by Sophos revealed the scammers had collected KYC (Know Your Customer) documents from individuals who resided in Malaysia, South Korea, China, Japan, and India.

Many of them believed they were buying or investing in a cryptocurrency, but in reality, their savings simply got siphoned off to an obscure bank account overseas. With the vast global financial system, it becomes near impossible for authorities to track down the source. And with cryptocurrencies, it becomes an exponentially difficult task.

Experts always recommend installing apps from trusted sources like Google's Play Store or Apple's App Store. External .apk (Android) or .ipa (iOS) files are not screened by any third party, posing an immediate risk to your phone and its data. If you're logging in to your account from a browser, always check the address bar for the "green lock" icon. It'll show you the website's certificate to authenticate whether the page you have visited is legitimate.

It is important to note that Sophos has shared details of these apps and they should now be picked up by malware detection apps. Hence, using anti-virus software on your phone will be highly suggested if you actively install apps directly, bypassing the app stores.

"Last but not least, if something seems risky or too good to be true – such as high returns on investment or someone from a dating site is asking you to transfer money or cryptocurrency assets into some 'great' account – then sadly, it probably is." the report cautioned.


SEE ALSO:
Good nutrition is vital if you are recuperating from the Coronavirus — here is what you should have
From BHEL to HEG and CG Power ⁠— these infrastructure stocks have turned ₹10,000 to as much as ₹30,600 in just six months
iPhone SE 3 launch date, specifications, price in India and everything else we know so far