Cybersecurity researchers have shared insights into a cryptocurrency trading scam that attacks iPhone users through popular dating platforms such as Bumble and Tinder.
Named CryptRom by researchers at Sophos, the scam first targeted people in Asia, and is now attacking users in the US and Europe as well.
A Bitcoin wallet belonging to the attackers reveals that the threat actors have minted nearly $1.4 million in cryptos from the scam.
- These are the best iPhone antivirus apps
- Protect your devices with these best antivirus software
- Here's our choice of the best malware removal software on the market
“The CryptoRom scam relies heavily on social engineering at almost every stage,” said Jagadeesh Chandraiah, senior threat researcher at Sophos, adding that the novel scam has the potential of doing a lot more damage than just stealing cryptos.
Gateway to scams
Unraveling the scam, Sophos says the threat actors begin by posting fake profiles on legitimate dating sites to lure in victims. Once baited, the victims are then persuaded to install and invest in a fake cryptocurrency trading app.
“At first, the returns look very good but if the victim asks for their money back or tries to access the funds, they are refused and the money is lost,” the researchers share.
The threats however don’t just end with the lost cryptos. Sophos notes that the threat actors use Apple’s enterprise signature mechanism to install apps directly on iOS devices circumventing the App Store.
Enterprise signature is designed for use by iOS developers to enable app developers to test iOS apps before submitting them to the official Apple App Store for review and approval.
“Until recently, the criminal operators mainly distributed the fake crypto apps through fake websites that resemble a trusted bank or the Apple App Store. The addition of the iOS enterprise developer system introduces further risk for victims because they could be handing the attackers the rights to their device and the ability to steal their personal data,” said Jagadeesh Chandraiah, senior threat researcher at Sophos.
Sophos believes the threat actors use the fake crypto trading app to gain remote management control over the devices of their victims, which exposes them to all kinds of malicious campaigns.
- These are the best ransomware protection tools
