ESET discovers fake cryptocurrency apps

Source: pixabay.com

Not surprisingly, cybercriminals were quick to notice this development and started upping their efforts in targeting cryptocurrency users with various scams and malicious apps. One is impersonating the popular hardware cryptocurrency wallet Trezor. The illegitimate app was connected to a fake cryptocurrency wallet app named “Coin Wallet – Bitcoin, Ripple, Ethereum, Tether,” which is capable of scamming unsuspecting users out of money.

“We haven’t previously seen malware misusing Trezor’s branding and were curious about the capabilities of such a fake app. After all, Trezor offers hardware wallets that require physical manipulation and authentication via PIN, or knowledge of the so-called recovery seed, to access the stored cryptocurrency,” explains Lukáš Štefanko, the ESET researcher who conducted the research, concerning his interest into this specific fake app.

Analysing the fake app, ESET found that it can’t do any harm to Trezor users’ crypto-savings given Trezor’s multiple security layers; however, it is connected to a fake cryptocurrency wallet app “Coin Wallet,” which is capable of scamming unsuspecting users out of money. “Both these apps were created based on an app template sold online,” he adds.

The app masquerading as a mobile wallet for Trezor was uploaded to Google Play on May 1, 2019, under the developer name “Trezor Inc.” Overall, the app’s page on Google Play appeared trustworthy at first glance. At the time of ESET’s analysis, the fake app even came up as the second most popular result when searching for “Trezor” on Google Play, right behind Trezor’s official app. However, the fake app is used to phish for login credentials.

The server used to harvest credentials from the fake Trezor app is hosted on coinwalletinc.com. Looking into the domain led ESET to another fraudulent app, named “Coin Wallet” on its website and on Google Play. They also overlap in code and interface. The website contains a link to Google Play, where the app was available from February 2019.

“The app claims it lets its users create wallets for various cryptocurrencies. However, its actual purpose is to trick users into transferring cryptocurrency into the attackers’ wallets – a classic case of what we’ve named wallet address scams in our previous research into cryptocurrency-targeting malware,” says Štefanko.

ESET has a few tips around how stay safe with cryptocurrencies online:

• Only trust cryptocurrency-related and other finance apps if they are linked from the official website of the service.
  
• Only enter your sensitive information into online forms if you are certain of their security and legitimacy.
  
• Keep your device updated.
  
• Use a reputable mobile security solution to block and remove threats.