The scam itself is subcontracted to affiliates, which have a front desk handling staffing, a tech team handling the technology involved, and a finance team looking after the money. Profits tend to be divided 60-40 \u2013 with 40% going to the head office.<\/p>\n
At the bottom of the pile are the keyboarders who liaise with, and trick the targets. These are often victims themselves, sometimes foreigners lured into the process by the promise of earning money, and kept in the process by the threat of violence.<\/p>\n
The new danger exposed by Sophos is not the scam (that\u2019s not new) but the criminals\u2019 success in getting malicious apps into the official app stores (Ace Pro and MBM_BitScan into the App Store, and BitScan into Google Play). This is not uncommon with Google Play, but unusual with Apple. In two separate examples that by-passed Apple\u2019s App Store review, a legitimate-looking app initially communicates with a benign back end. Nothing malicious can be seen, so the apps passed Apple\u2019s review.<\/p>\n
Only after the app is accepted, downloaded, and launched does the developer switch domains, from the benign back end to a malicious server that delivers the malicious content.<\/p>\n \u201cWhen we originally began investigating CryptoRom scams targeting iOS users, the scammers would have to persuade users to first install a configuration profile before they could install the fake trading app,\u201d comments Jagadeesh Chandraiah, senior threat researcher at Sophos. \u201cThis obviously involves an additional level of social engineering\u2014a level that\u2019s hard to surmount.\u201d<\/p>\n Many potential victims would be \u2018alerted\u2019 that something wasn\u2019t right if they cannot directly download a supposedly legitimate app. But by getting an application into the App Store, the scammers have vastly increased their potential victim pool, particularly since most users inherently trust Apple.<\/p>\n \u201cBoth apps are also unaffected by iOS\u2019 new Lockdown mode<\/a>, which prevents scammers from loading mobile profiles helpful for social engineering,\u201d continued Chandraiah. \u201cIn fact, these CryptoRom scammers may be shifting their tactics \u2013 that is, focusing on bypassing the App Store review process \u2013 in light of the security features in Lockdown.\u201d<\/p>\n The scam still requires extensive social engineering. The victim is typically approached via a dating app, and then invited to switch the conversation to WhatsApp. In one case, the victim was based in Switzerland. The scammer or scammers used a manufactured profile of a woman based in London, with a full and compelling Facebook profile complete with professional or stolen location and lifestyle photos.<\/p>\n \u201cAfter establishing a rapport, the criminals behind the profile told the victim that \u2018her\u2019 uncle worked for a financial analysis firm, and invited the victim to do cryptocurrency trading together.\u201d It was at this point that the victim was introduced to the fake application in the app store.<\/p>\n In such cases, a degree of patience is still demonstrated by the attackers. Crypto investment begins slowly, and the victim can even make withdrawals from the crypto account. But the investment goes straight to the criminals. By the time the victim realizes that something is wrong, both the money and the scammers are gone.<\/p>\n This scam, says the Sophos report, \u201cis a well-organized, syndicated scam operation that uses a combination of romance-centered social engineering and fraudulent crypto trading applications and websites to lure victims and steal their money after gaining their confidence.\u201d The worrying possibility for the future is that emerging artificial intelligence such as ChatGPT<\/a> will make such detailed and professional social engineering even more compelling \u2013 and widely available to criminals less sophisticated.<\/p>\n Related<\/strong>: 2,000 People Arrested Worldwide for Social Engineering Schemes<\/a><\/p>\n Related<\/strong>: Ongoing Bitcoin Scams Demonstrate Power of Social Engineering Triggers<\/a><\/p>\n Related<\/strong>: Meet Domen, a New and Sophisticated Social Engineering Toolkit<\/a><\/p>\n Related<\/strong>: Social Engineering: Attackers\u2019 Reliable Weapon<\/a><\/p>\n The post Fraudulent \u201cCryptoRom\u201d Apps Slip Through Apple and Google App Store Review Process<\/a> appeared first on SecurityWeek<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" Pig Butchering, also known as Sha Zhu Pan and CryptoRom, is an ugly name for an ugly scam. It is not new. What is new is that apps perpetrating the scam can be downloaded from the official Apple and Android app stores \u2013 giving them greater apparent validity to targets. The scam is a version […]<\/p>\n","protected":false},"author":2,"featured_media":16910,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[184,185,27,30,70,48],"tags":[],"class_list":["post-16909","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-android","category-cryptorom","category-cybercrime","category-fraud-identity-theft","category-ios","category-mobile-wireless"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/posts\/16909","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/comments?post=16909"}],"version-history":[{"count":0,"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/posts\/16909\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/media\/16910"}],"wp:attachment":[{"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/media?parent=16909"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/categories?post=16909"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/tags?post=16909"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"Graphical](\"https:\/\/lh5.googleusercontent.com\/NRitzfxjdY9_GZqz1F73epOjVVJhQKHoEqd03dGR3xhKF4vP5o1HFLrf8mz5oDXZjN9qlrI4gACtq5HVvcBEdG1Noxdb3a5LRah3DYRmT_4CSuiusAiifTTPoIrxdTv5lgheFeu34ylmEemeBAgGfuo\")