Sunday, November 24, 2024
HomeCyber Security NewsFirst Ever iOS Trojan Steals Facial Recognition Data

First Ever iOS Trojan Steals Facial Recognition Data

Published on

A novel, very sophisticated mobile Trojan dubbed GoldPickaxe.iOS that targets iOS users exclusively was discovered to collect facial recognition data, intercept SMS, and gather identity documents.

The Asia-Pacific region includes the majority of those impacted by this harmful activity. On the other hand, two APAC countries that deserve particular consideration are Vietnam and Thailand.

The GoldPickaxe family, which comes in iOS and Android variants, is based on the GoldDigger Android Trojan (discovered in October 2023) and receives frequent modifications to improve its functionality and avoid detection. 

- Advertisement - SIEM as a Service

“To exploit the stolen biometric data from iOS and Android users, the threat actor creates deepfakes using AI face-swapping services to replace their faces with those of the victims. This method could be used by cybercriminals to gain unauthorized access to victims’ bank accounts”, Group-IB researchers shared with Cyber Security News.

Document
Live Account Takeover Attack Simulation

How do Hackers Bypass 2FA?

Live attack simulation Webinar demonstrates various ways in which account takeover can happen and practices to protect your websites and APIs against ATO attacks.

Timeline of GoldFactory’s Trojans

Group-IB has linked the entire threat cluster to a single threat actor known as GoldFactory, which has created an advanced collection of mobile banking malware.

Timeline of GoldFactory’s Trojans
Timeline of GoldFactory’s Trojans

The traditional Android banking Trojan GoldDigger exploits Accessibility Service to provide hackers access to the device. Another Android malware that increases GoldDigger’s capability is called GoldDiggerPlus. 

GoldDiggerPlus features an embedded Trojan called GoldKefu, which contains web fakes and allows real-time voice conversations with victims. A Trojan called GoldPickaxe was created for the iOS and Android operating systems used to obtain and exfiltrate biometric data and personal information from victims.

GoldPickaxe.iOS Employs a Notable Distribution Scheme

Thai financial institutions extensively utilize facial recognition for login authentication and transaction verification. Because of this, GoldPickaxe’s facial recognition video capture and unique features give attackers the chance to access bank accounts without authorization.

GoldPickaxe Trojans extract money from victims’ devices
GoldPickaxe Trojans extract money from victims’ devices

Hackers are using their own Android smartphones to install banking apps, and they are exploiting the captured face scans to get over facial recognition security measures and gain unauthorized access to victims’ accounts.

Screenshots displaying how GoldPickaxe for Android captures a facial biometric profile
Screenshots displaying how GoldPickaxe for Android captures a facial biometric profile

Cybercriminals pose as government officials in Thailand and convince victims to utilize LINE, one of the nation’s most widely used chat services. The LINE user needs to add another as a friend to initiate a chat.

 “Malicious links are distributed through messengers to encourage the installation of the app. Victims are then lured into a fraudulent application posing as a ‘Digital Pension’ app, purportedly enabling them to receive their pension digitally”, according to Thailand Banking Sector CERT (TB-CERT).

Researchers noticed in one instance the CryptoRAM campaigns, in which fraudsters disseminated fake cryptocurrency applications by using Apple’s TestFlight platform. 

Another technique is manipulating Apple devices using Mobile Device Management (MDM). MDM is an all-inclusive and centralized approach to controlling and safeguarding mobile devices inside an organization, including tablets and smartphones.

Thus, a proactive and comprehensive strategy for cybersecurity must include user education and integrated current security techniques to proactively identify the introduction of new Trojans and alert end users.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Nearest Neighbor Attacks: Russian APT Hack The Target By Exploiting Nearby Wi-Fi Networks

Recent research has revealed that a Russian advanced persistent threat (APT) group, tracked as...

240+ Domains Used By PhaaS Platform ONNX Seized by Microsoft

Microsoft's Digital Crimes Unit (DCU) has disrupted a significant phishing-as-a-service (PhaaS) operation run by...

Russian TAG-110 Hacked 60+ Users With HTML Loaded & Python Backdoor

The Russian threat group TAG-110, linked to BlueDelta (APT28), is actively targeting organizations in...

Earth Kasha Upgraded Their Arsenal With New Tactics To Attack Organizations

Earth Kasha, a threat actor linked to APT10, has expanded its targeting scope to...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Nearest Neighbor Attacks: Russian APT Hack The Target By Exploiting Nearby Wi-Fi Networks

Recent research has revealed that a Russian advanced persistent threat (APT) group, tracked as...

240+ Domains Used By PhaaS Platform ONNX Seized by Microsoft

Microsoft's Digital Crimes Unit (DCU) has disrupted a significant phishing-as-a-service (PhaaS) operation run by...

Russian TAG-110 Hacked 60+ Users With HTML Loaded & Python Backdoor

The Russian threat group TAG-110, linked to BlueDelta (APT28), is actively targeting organizations in...