Daily Tech News, Interviews, Reviews and Updates

Sophos Details First Fake Apps Found on Apple’s App Store Used by Cybercriminals for CryptoRom Schemes

How do fraudulent applications make it to the App Store?

Sophos X-Ops researchers believe the scammers successfully bypassed strict App Store security protocols by connecting to a remote website with benign functionality when originally submitting for review; however, once the apps were approved, the scammers redirected apps to an Asian-registered domain
Sophos X-Ops researchers believe the scammers successfully bypassed strict App Store security protocols by connecting to a remote website with benign functionality when originally submitting for review; however, once the apps were approved, the scammers redirected apps to an Asian-registered domain

OXFORD, United Kingdom, Feb. 01, 2023 (GLOBE NEWSWIRE) — Sophos, a global leader in innovating and delivering cybersecurity as a service, today released new findings on CryptoRom scams—elaborate financial fraud schemes that prey on and trick dating app users into making fake cryptocurrency investments—in its latest report, “Fraudulent Trading Apps Sneak into Apple and Google App Stores.” The report details the first fake CryptoRom apps —Ace Pro and MBM_BitScan— to successfully bypass Apple’s strict security protocols. Previously, cybercriminals used workaround techniques to convince victims to download illegitimate iPhone apps that were not sanctioned by the Apple App Store. Sophos immediately notified Apple and Google; both have since removed the fraudulent apps from their respective stores.

“In general, it’s hard to get malware past the security review process in the Apple App Store. That’s why, when we originally began investigating CryptoRom scams targeting iOS users, the scammers would have to persuade users to first install a configuration profile before they could install the fake trading app. This obviously involves an additional level of social engineering—a level that’s hard to surmount. Many potential victims would be ‘alerted’ that something wasn’t right when they couldn’t directly download a supposedly legitimate app. By getting an application onto the App Store, the scammers have vastly increased their potential victim pool, particularly since most users inherently trust Apple,” said Jagadeesh Chandraiah, senior threat researcher, Sophos. “Both apps are also not affected by iOS’ new Lockdown mode, which prevents scammers from loading mobile profiles helpful for social engineering. In fact, these CryptoRom scammers may be shifting their tactics—i.e., focusing on bypassing the App Store review process—in light of the security features in Lockdown.”

To lure the victim who was conned with Ace Pro, for instance, the scammers created and actively maintained a fake Facebook profile and persona of a woman supposedly living a lavish lifestyle in London. After building a rapport with the victim, the scammers suggested the victim download the fraudulent Ace Pro app and the cryptocurrency fraud unfolded from there.

Sophos X-Ops

Ace Pro is described in the app store as a QR code scanner but is a fraudulent crypto trading platform. Once opened, users see a trading interface where they can supposedly deposit and withdraw currency. However, any money deposited goes directly to the scammers. In order to get past App Store security, Sophos believes the scammers had the app connect to a remote website with benign functionality when it was originally submitted for review. The domain included code for QR scanning to make it look legitimate to app reviewers. However, once the app was approved, the scammers redirected the app to an Asian-registered domain. This domain sends a request that responds with content from another host that ultimately delivers the fake trading interface.

MBM_BitScan is also an app for Android, but it is known as BitScan on Google Play. The two apps communicate with the same Command and Control (C2) infrastructure; this C2 infrastructure then communicates with a server that resembles a legitimate Japanese crypto firm. Everything else that is malicious is handled in a web interface, which is why it is hard for Google Play’s code reviewers to detect it as fraudulent.

CryptoRom, a subset of family of scams known as sha zhu pan (杀猪盘)—literally “pig butchering plate”—is a well-organized, syndicated scam operation that uses a combination of romance-centered social engineering and fraudulent crypto trading applications and websites to lure victims and steal their money after gaining their confidence. Sophos has been tracking and reporting on these scams that reap millions of dollars for two years.

Learn more about the criminals behind the CryptoRom rings and these fraudulent apps in “Fraudulent CryptoRom Trading Apps Sneak into Apple and Google App Stores” on Sophos.com.

Learn More About

  • “CryptoRom” scams and how they target iOS users
  • Liquidity mining and how it contributes to cryptocurrency crimes
  • The threat landscape and trends likely to impact cybersecurity in the 2023 Threat Report
  • Sophos X-Ops and its groundbreaking threat research by subscribing to the Sophos X-Ops blogs
  • Attacker dwell times and insights into tactics, techniques and procedures (TTPs) in Sophos’ Active Adversary Playbook 2022

About Sophos
Sophos is a worldwide leader and innovator of advanced cybersecurity solutions, including Managed Detection and Response (MDR) and incident response services and a broad portfolio of endpoint, network, email, and cloud security technologies that help organizations defeat cyberattacks. As one of the largest pure-play cybersecurity providers, Sophos defends more than 500,000 organizations and more than 100 million users globally from active adversaries, ransomware, phishing, malware, and more. Sophos’ services and products connect through its cloud-based Sophos Central management console and are powered by Sophos X-Ops, the company’s cross-domain threat intelligence unit. Sophos X-Ops intelligence optimizes the entire Sophos Adaptive Cybersecurity Ecosystem, which includes a centralized data lake that leverages a rich set of open APIs available to customers, partners, developers, and other cybersecurity and information technology vendors. Sophos provides cybersecurity-as-a-service to organizations needing fully-managed, turnkey security solutions. Customers can also manage their cybersecurity directly with Sophos’ security operations platform or use a hybrid approach by supplementing their in-house teams with Sophos’ services, including threat hunting and remediation. Sophos sells through reseller partners and managed service providers (MSPs) worldwide. Sophos is headquartered in Oxford, U.K. More information is available at www.sophos.com.

A photo accompanying this announcement is available at https://www.globenewswire.com/NewsRoom/AttachmentNg/c765eb8f-059b-422f-9b84-60e797e69aae

CONTACT: Contact: Sam Powers, [email protected]

Disclaimer: The above press release comes to you under an arrangement with GlobeNewswire. TheTechOutlook.com takes no editorial responsibility for the same.



Readers like you help support The Tech Outlook. When you make a purchase using links on our site, we may earn an affiliate commission. We cannot guarantee the Product information shown is 100% accurate and we advise you to check the product listing on the original manufacturer website. Thetechoutlook is not responsible for price changes carried out by retailers. The discounted price or deal mentioned in this item was available at the time of writing and may be subject to time restrictions and/or limited unit availability. Amazon and the Amazon logo are trademarks of Amazon.com, Inc. or its affiliates Read More
You might also like

This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. Accept Read More