Technology

The Dark Side of iPhone Malware: Unveiling the Threats Targeting Vietnamese Users

The GoldPickaxe malware targets iPhone users in Vietnam and Thailand, stealing login credentials and bypassing biometric security measures by stealing facial data. This sophisticated threat actor has crafted a cunning campaign, demonstrating a high level of technical prowess and a deep understanding of their targets. With a stealthy approach, they aim to compromise the security and privacy of unsuspecting individuals, highlighting the evolving nature of cyber threats and the need for constant vigilance.

Administrator

3 September, 2024

183

According to Group-IB, this could be a sign that GoldPickaxe is targeting Vietnamese users. “Based on the specific requirement of face scanning, along with the fact that GoldFactory is operating in the region, we suspect that they may have started deploying GoldPickaxe in Vietnam,” Group-IB stated.

In a warning about online scams issued by the Department of Information Security under the Ministry of Information and Communications in February, there was a case of a user in Hanoi being tricked into installing fake public service software. The software requested a video verification, and the next day, the user’s securities account was sold and billions of dong were transferred out.

An iPhone being used for face scanning. Photo: Luu Quy

The presence of GoldPickaxe at a conference on finance and banking in Ho Chi Minh City in mid-March also raised concerns among organizations. According to Troy Le, representative of BShield, a security tool developer supporting many major applications in Vietnam, this malware is dangerous because it has been successfully exploited on both iOS and Android platforms, while also collecting biometric data of users. As Thailand has implemented biometric authentication, including facial recognition, for large transactions, and Vietnam is also about to apply this method, GoldPickaxe becomes a new challenge for users and platforms in protecting accounts.

How does GoldPickaxe infiltrate accounts?

First, the attackers will try to get the victim to install the malicious application on their device through social engineering techniques. In the case of the Hanoi victim mentioned above, they impersonated a government agency to trick the user into installing the fake public service software. In Thailand, common scenarios involve tax refund and electricity bill payment assistance software.

For Android devices, users only need to install the application through an apk file. Meanwhile, for iOS, attackers will exploit Apple’s application testing platform, TestFlight, or convince the victim to install a Mobile Device Management (MDM) profile, giving them full control over the device.

Attack mechanism of GoldPickaxe. Source: Group-IB

Once inside the device, GoldPickaxe activates certain privileges, such as SMS filtering and internet access. At the same time, the fake application will ask the user to verify their identity with personal documents and a video recording. This video is sent to the hacker’s server, becoming material for deepfakes, face swapping using AI.

According to expert Troy Le, the malware will quietly collect personal information from the device and secretly record data on the user’s activities and inputs, creating log files. Additionally, it also collects facial data and possibly the victim’s IP address to mimic their behavior, thereby tricking services into believing it is the genuine user.

“With this data, the attacker does not need to directly perform illegal transactions from the victim’s phone. Instead, they collect all the necessary information to access the user’s banking application from another device,” said Troy Le.

How to stay safe from GoldPickaxe?

The Department of Information Security has continuously issued warnings and recommendations for users to not provide personal information or install applications from unknown sources to prevent account theft. However, in reality, attack scenarios and methods are constantly changing, causing many people to fall victim despite being cautious.

From the perspective of a security platform developer, Troy Le believes that banks and financial organizations also need to take proactive measures to protect their users.

After implementing BShield for many financial and banking applications in Vietnam, Troy Le pointed out that some platforms and services still have weaknesses, such as lacking a mechanism to detect unsafe devices and take timely preventive actions, and lacking continuous monitoring during the application’s operation. This allows hackers to take control of the victim’s account once they pass the initial verification stage. Additionally, some applications may have API vulnerabilities, allowing malware to interfere and modify the application’s behavior, enabling man-in-the-middle attacks.

“Financial and banking applications are always the primary targets of hackers. Therefore, they need to establish mechanisms to protect both their users and their services,” the expert recommended.

According to Group-IB, the malware from the GoldFactory group also has many features that can trick users, such as fake application alerts, fake call screens, and deceptive messages prompting the victim to perform certain actions. Users should be cautious if they notice any unusual behavior, such as rapid battery drain, unusual device heat, strange notifications, high data usage, or applications requesting excessive permissions.

Frequently asked questions

iPhone malware refers to malicious software specifically designed to target Apple’s iOS operating system. While iPhones are generally considered more secure than Android devices, they are still vulnerable to malware attacks. The article reveals a rise in iPhone malware targeting Vietnamese users, with threats including data theft, unauthorized access, and financial loss.

The malware campaign uncovered in the article specifically targets Vietnamese iPhone users through a combination of social engineering and exploit techniques. Malicious apps masquerading as legitimate Vietnamese applications are used to trick users into installing them. Once installed, these apps can gain unauthorized access to sensitive data, including contacts, messages, and even banking information.

There are several indicators that your iPhone may be infected with malware. Unexplained data usage or battery drain, unexpected crashes or behavior, and the presence of unfamiliar apps or settings can all be signs of a malware infection. It’s important to remain vigilant and keep your device updated with the latest security patches to lower the risk of infection.

To protect your iPhone from malware, it’s crucial to follow basic cybersecurity practices. Only download apps from trusted sources, such as the App Store, and be cautious of links or attachments in messages. Keep your iOS version and apps up to date, as updates often include security patches. Additionally, consider using a reputable mobile security solution to add an extra layer of protection to your device.

If you suspect that your iPhone has been infected with malware, it’s important to act quickly. Disconnect your device from the internet and put it into airplane mode to prevent further damage or data exfiltration. Perform a factory reset to erase all content and settings, which should remove the malware. After resetting your device, change all important passwords, especially for banking and email accounts, as a precautionary measure.