Face ID and account stealing trojan appears targeting Vietnamese users

Many people choose to use iPhone because they think this device is safer than Android, but that view is no longer entirely correct when security experts recently discovered a type of trojan (malware that disguises a legitimate program) designed specifically for Apple's smartphone model.

The latest report from security company Group-IB said that the trojan called GoldDigger that once "made waves" on Android now has a variant that targets information of iPhone and iPad users. The company said that this is the first time there is a trojan specifically designed for iOS, capable of collecting facial recognition data (Face ID), identity-related documents and even SMS content.

Mã độc tấn công thiết bị iOS thông qua TestFlight hoặc cấu hình MDM — Malware attacks iOS devices via TestFlight or MDM configuration

This malware was first discovered in October 2023, and now has a new generation called GoldPickaxe, which is more advanced when it separates the version that operates on Android and iOS devices. Once it has penetrated the phone, GoldPickaxe will collect sensitive information to help hackers attack bank accounts as well as financial applications on the victim's device. Not stopping there, the obtained biometric data can be used to create AI Deepfake so that attackers can impersonate users in the digital environment.

More worryingly, according to Phone Arena , GoldPickaxe is currently targeting victims in Vietnam and Thailand. If successful here, the perpetrators could continue to spread the malware in other markets such as the US, Europe, and eventually globally.

On Android, installing trojans is relatively simple as they can easily "hide" themselves as fake apps or targeted phishing campaigns. On iOS, it will be more difficult because Apple's ecosystem is famous for being "closed off", but hackers still find a way to break in.

Initially, the iOS trojan was distributed through Apple TestFlight, a platform that allows developers to release test versions of their apps without going through the rigorous App Store review process. But after Apple removed those programs from TestFlight, hackers moved to an advanced solution: attacking through Mobile Device Management (MDM) configurations, a common form of corporate machine management.

Group-IB has reported the issue to Apple so that the manufacturer can find a solution to handle the malware targeting users. While waiting for a security patch from the company, users should proactively protect their devices and personal information, do not install applications from untrusted sources, avoid using TestFlight and applications from here, and always update the latest version of the operating system on the device.

Fraudulent forms and attacks targeting user accounts are appearing more and more frequently and the scenarios are constantly changing to become more sophisticated and unpredictable. Recently, a female nurse in the US lost up to 24,000 USD (nearly 590 million VND) in savings because she believed a fake call. The scammer used a software that can change the information displayed on the caller ID to impersonate the bank employee where the person deposited their savings, then advised and lured the victim to transfer all the money to another "safer" account.

As artificial intelligence becomes increasingly smarter, hackers are also constantly applying this technology for malicious purposes, making detection much more difficult.

Source link