Group-IB researchers have discovered new “pig butchering” scams via fake trading apps on Google Play and Apple’s App Store.
The apps have now been removed from the official Android and iOS stores, after having collected many thousands of downloads.
Pig butchering is a type of investment fraud in which the victim is convinced that they will receive a lot of money if they invest in a supposedly legitimate trading platform.
The scam is revealed when the victim attempts to cash out their money, which the fraudsters have already stolen.
See also: Meta: Collaboration with British banks to combat fraud
Fake trading apps on Google Play and App Store
The malicious applications, which Group-IB categorizes as part of the “UniShadowTrade” malware, were created using the UniApp framework. They were first detected in May:
- SBI-INT (iOS),
- Finance Insights (Android)
- Finans Trader6 (Android)
The last two appear to have had at least 5,000 downloads.
Group-IB also said that the malicious apps could mimic a variety of legitimate cryptocurrency and trading platforms.
The researchers report that the apps were disguised as tools for “algebraic mathematical formulas and 3D graphics volume area calculations” on iOS and as financial news aggregators on Android.
After installation, they redirected victims to fake trading platforms, which they could only access via invitation codes.
See also: Millions of Britons have fallen victim to scams
How did the pig butchering scam start?
According to Group-IB researchers, the scammers started chatting with their victims through dating apps and used social engineering to gain their trust. They then recommended trading apps on Google Play and the App Store, promising big profits.
The apps asked users to upload numerous documents, such as IDs and passports, both to lend legitimacy to the investment process and to steal as much information as possible.
After the malicious apps were removed from stores in June, threat actors created phishing sites and continued their activities.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Protection
To avoid pig butchering and investment scams, it is recommended to do good research before working with a platform.
Although Google Play and the App Store have defense mechanisms, some malicious apps still manage to make it onto the store. For this reason, users should always verify the authenticity of an app before installing it. This can be done reviews user.
See also: Why are there an increase in credit card fraud alerts?
Additionally, users can visit the official website of a service and find the link there to download the application from the app store.
It's also important to check the permissions that apps request, even if they're on Google Play. If an app asks for access to personal information that doesn't seem necessary for it to function, it's best to avoid installing it.
Users should at least be wary of spam emails and URLs promising high returns on investment, as scams are commonly promoted this way.
Finally, it is also necessary to use reliable security software and regularly update the operating system and applications.
Source: www.bleepingcomputer.com
