BitScam & CloudScam: Crypto Scamming Apps
How Lookout Detects and Protects
Cybercriminals will oftentimes try to use legitimate capabilities to obfuscate malicious activity. The true intentions of an app are oftentimes hidden in the data access permissions and behaviors, and even then, can be difficult to uncover without the right tools. Static and dynamic analysis of the industry’s largest mobile dataset enables Lookout researchers to protect customers by continuously discovering and researching new threats. Devices with Lookout installed can detect and be alerted to these two families as well as any other apps with risky functionality built in.
To learn more about the technical specifications of this campaign, including IOCs, read the full article here.
Key Findings
- These families enable threat actors to use legitimate functionality to carry out scams
- The apps that were on the Play Store have been removed, but hundreds more still exist on third-party app stores.
- Indicators of Compromise (IoCs) for both families are available here.
Background and Discovery
Researchers at Lookout have discovered almost 200 Android apps, including 25 on the Play Store, scamming cryptocurrency investors out of money. The apps advertise that they provide crypto mining services for a fee, but upon further analysis Lookout researchers discovered no mining takes place and these services are never delivered.
Capabilities and Affected Parties
BitScam and CloudScam, which are the two families behind the discovered apps, are able to fly under the radar because they don’t actually execute any malicious code. By using legitimate payment processes, the families enable these apps to collect money for services that don’t exist. Even though the apps that were found on the Play Store have been removed, the others are still circulating on third-party app stores. In addition, while BitScam and CloudScam have now been exposed, threat actors could continue to build apps with these families and create evolved versions to try to elude security tools.
Authors
Lookout
Lookout, Inc. is the data-centric cloud security company that uses a defense-in-depth strategy to address the different stages of a modern cybersecurity attack. Data is at the core of every organization, and our approach to cybersecurity is designed to protect that data within today’s evolving threat landscape no matter where or how it moves.
.png)
