The recent rise in cryptocurrency scams appearing on the Android platform in disguise has shown that such incidents are not exclusive to PCs and also highlight the importance of knowing what to look out for so you do not unintentionally take part.<\/p>\n
The growing prices and popularity of cryptocurrencies don\u2019t just attract masses of potential users, but also inspire cyber-crooks to find new and creative ways to get their sticky fingers on all those virtual coins. Of course, cryptocurrency scams are not exclusive to PCs and have already emerged on the Android platform, using a wide array of disguises.<\/p>\n
Fake cryptocurrency exchange apps<\/p>\n
Cryptocurrency exchanges are an attractive target for crooks not only due to their popularity with cryptocurrency enthusiasts, but also because many don\u2019t offer a mobile app. Such \u201cunclaimed territory\u201d acts like a magnet for scammers, who waste no time coming up with malicious fakes.<\/p>\n
Typically, the purpose of such fake apps is to phish for login credentials to the impersonated official exchange. Attackers then use the stolen credentials to take over the compromised accounts. To lure users into giving away their passwords, crooks try to raise as little suspicion as possible \u2013 the developer name, app icon and user interface usually mimic those of the legitimate service, and the app may even appear to have a good overall rating thanks to fake reviews.<\/p>\n
Recent cases of these scams are phishing apps, discovered on Google Play last year and resurfacing frequently ever since, that impersonate the cryptocurrency exchange Poloniex.<\/p>\n
Figure 1 \u2013 The fake Poloniex apps on Google Play<\/p>\n
Fake cryptocurrency wallet apps<\/p>\n
Similar phishing schemes also afflict users of cryptocurrency wallets, only instead of a password, the attackers are directly after the wallets\u2019 private keys and phrases. In practice, this means that the stakes are higher for users of cryptocurrency wallets \u2013 a stolen password to a cryptocurrency exchange may be reset with the help of the exchange holding the user\u2019s private key, but in the case of a wallet, it\u2019s the private key that gets compromised, with no one else to save the day.<\/p>\n
Lately, we\u2019ve observed this kind of malicious behavior in apps impersonating MyEtherWallet, a popular, open-source, Ethereum wallet. The apps, uploaded to Google Play multiple times over recent months, attempt to steal users\u2019 private keys and\/or mnemonic phrases using various bogus login forms. Like the Poloniex exchange, MyEtherWallet doesn\u2019t have an official mobile app, which makes it attractive for imposters.<\/p>\n
Figure 2 \u2013 The fake MyEtherWallet apps on Google Play<\/p>\n
Besides phishing apps, we\u2019ve also analyzed fake cryptocurrency wallets that merely try to trick victims into transferring coins to the attackers\u2019 wallets. Such wallet address scams follow a simple procedure \u2013 they pretend to generate a public key for a new wallet and instruct users to send their digital coins to the generated address. If users follow this instruction, they soon find that the coins they sent are gone.<\/p>\n
Figure 3 \u2013 Wallet address scam apps targeting users of various cryptocurrenciesAndroid crypto-mining malware<\/p>\n
With the recent boom in cryptocurrency mining, the number of Android-based miners has also been rising. Whether a crypto-mining app is considered malicious comes down to consent \u2013 are users knowingly using their device for cryptocurrency mining, or is the device being hijacked with someone else making the profit? When the latter is the case, we speak of crypto-mining malware.<\/p>\n
Recently, we have discovered that a version of the popular game Bug Smasher, installed from Google Play between 1 and 5 million times, has been secretly mining the cryptocurrency Monero on users\u2019 devices.<\/p>\n
Figure 4 \u2013 The Bug Smasher app with hidden mining functionality<\/p>\n
Fake crypto-miners and free giveaways<\/p>\n
A separate category of cryptocurrency scams belongs to apps that pretend to mine cryptocurrency for the user, but in reality don\u2019t do much else than display ads. Some of the fake miners we\u2019ve analyzed also try to trick users into rating them with 5 stars. While these apps aren\u2019t malware per se, we consider them unwanted due to their deceptive nature.<\/p>\n
Interestingly, the fraudsters behind some fake miners don\u2019t seem to worry about the infeasibility of their promises \u2013 besides countless fake bitcoin miners, we have also found apps that promise to mine the cryptocurrency Ripple (XRP), a non-minable currency by definition.<\/p>\n
Figure 5 \u2013 Fake Ripple miners on Google Play<\/p>\n
All the apps mentioned above are detected and blocked by ESET systems and have been suspended from the Google Play store. Users with Google Play Protect enabled are protected via this mechanism.<\/p>\n
How to stay safe<\/p>\n
Here\u2019s what you can do to avoid falling victim to cryptocurrency scams on Android:<\/p>\n
Treat cryptocurrency exchanges and wallets with the same level of caution as your mobile banking apps.<\/p>\n
When downloading a mobile app for a cryptocurrency exchange or wallet, make sure the service really offers a mobile app. The official app should be linked on the service\u2019s official website.<\/p>\n
If the option is available, use 2-factor-authentication to protect your exchange or wallet accounts with an extra layer of security.<\/p>\n
When downloading apps from Google Play, pay attention to their number of downloads, as well as app ratings and reviews.<\/p>\n
Keep your Android device updated and use a reliable mobile security solution to protect it from the latest threats<\/p>\n","protected":false},"excerpt":{"rendered":"
The recent rise in cryptocurrency scams appearing on the Android platform in disguise has shown that such incidents are not exclusive to PCs and also highlight the importance of knowing what to look out for so you do not unintentionally take part. The growing prices and popularity of cryptocurrencies don\u2019t just attract masses of potential […]<\/p>\n","protected":false},"author":2,"featured_media":1618,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_meta-robots-noindex":"","_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_pr_autopilot_social_copy":"","_yoast_wpseo_opengraph_title":"","_yoast_wpseo_opengraph_description":"","_yoast_wpseo_opengraph_image":"","_yoast_wpseo_opengraph_image_id":0,"_yoast_wpseo_twitter_title":"","_yoast_wpseo_twitter_description":"","_yoast_wpseo_twitter_image":"","_yoast_wpseo_twitter_image_id":0,"_yoast_wpseo_primary_category":0,"_extra_hide_author_box":"1","_extra_featured_post":"","_partner_post_id":0,"footnotes":""},"categories":[439],"tags":[],"class_list":["post-7772","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","et-has-post-format-content","et_post_format-et-post-format-standard"],"yoast_head":"\n