Malware disguised as cryptocurrency wallets are used to steal from mobile Apps. Cryptocurrency has been booming for a few years now, pulling in a lot of new investors who just want to see what’s going on. This has been good for plenty of people and boosted the profiles of tokens beyond the more well-known Bitcoin and Ethereum — but the influx of new investors has also given scammers a much larger field of victims to target, and security researchers with Eset uncovered a complex scheme involving Android and iOS apps that look like well-known cryptocurrency wallets but are actually hiding malicious trojans designed to steal crypto instead.
Eset detailed its research in a post for the firm’s We Live Security blog, and what the company discovered revealed in part just how easy it is for cyberattackers to use internet buzz to lure a host of new victims. Beginning in 2021, Eset says it discovered “dozens” of Android and iOS apps that looked like legit crypto wallets such as Metamask or Coinbase — but they were carrying malware payloads and being distributed through sketchy websites that only appeared trustworthy. The malware operators were able to steal the seed phrases of their unwitting victims, giving them access to their real wallets.
The research conducted by ESET found a sophisticated scheme run by some anonymous attackers and identified over 40 websites impersonating popular crypto wallets. These websites target mobile users and force visitors by different techniques to let them download malicious wallet apps.
Although the initial evidence suggested that the target could be Chinese users, it was later found that the scheme could be aimed at anyone using the English language on their phones.
“They are not targeting only Chinese users, since most of the distributed fake websites and apps are in the English language. Because of that, I believe it might affect anyone in the world (if they speak English),” Lukas Stefanko, Malware Analyst at ESET, told Gadgets 360.
The first trace of the distribution vector of the trojanised wallets was spotted in May 2021. The attackers used different Telegram groups to enroll people to distribute the Malware disguised apps, according to the report.
Based on the information obtained, the researchers found that attackers were giving people a 50 percent commission on the stolen contents of the wallet. This was aimed to bring more people on board for circulating the malware.
The researchers also noticed that the Telegram groups were shared and promoted in some Facebook groups, with the goal of searching for more distribution partners for the malware. It could eventually expand the scope of malicious attacks by getting middlemen for targeting individuals.
According to the researchers, the Malware disguised as cryptocurrency wallets works as legitimate crypto wallets, such as imToken, Bitpie, MetaMask, TokenPocket, and OneKey.
The apps behave differently depending on the operating system it was installed on, the researchers said.
On Android, the apps targeted new crypto users who do not have a legitimate wallet app installed on their devices. The wallet apps were using the same package name to disguise themselves as their original counterparts. However, they were signed using a different certificate. This restricts these apps to not overwriting the official wallet on the device.
However, on iOS, the malicious crypto wallet apps could be installed simultaneously alongside their legitimate version. The malicious apps would only be installed through a third-party source, though the official version could be from the App Store.
Once installed, the researchers found that the apps could steal seed phrases that are generated by a crypto wallet to give access to the crypto associated with that wallet. These phrases were spotted shared with the attackers’ server or with a secret Telegram chat group.
ESET researchers also discovered 13 Malware disguised as cryptocurrency wallets apps available on the Google Play store that were removed in January on the basis of their request. The apps impersonated the legitimate Jaxx Liberty Wallet app and were installed more than 1,100 times.
The researchers advise users to download and install apps only from official sources, such as Google Play in the case of Android and Apple’s App Store for iPhone consumers. Users are also recommended to quickly uninstall apps if they find them of malicious nature. In the case of iOS, users should also remove the configuration profile of malicious apps