Cyber security researchers on Monday revealed an international cryptocurrency trading scam targeting iPhone users through popular dating apps such as Bumble and Tinder and putting users’ data at risk.
Cyber security firm Sophos uncovered a Bitcoin wallet controlled by the attackers that contain nearly $1.4 million in cryptocurrency, allegedly collected from victims.
Sophos researchers have code-named the threat “CryptoRom” which relies heavily on social engineering at almost every stage.
First, the attackers post convincing fake profiles on legitimate dating sites.
“Once they’ve made contact with a target, the attackers suggest continuing the conversation on a messaging platform. They then try to persuade the target to install and invest in a fake cryptocurrency trading app,” said Jagadeesh Chandraiah, a senior threat researcher at Sophos.
“Our research shows that the attackers are making millions of dollars with this scam,” he said in a statement.
In addition to stealing money, the attackers can also gain access to victims’ iPhones.
When an iOS device user visits one of the sites used by these scams, a new profile gets downloaded to their device. Instead of a normal ad hoc profile, it is an MDM provisioning profile signed with an Enterprise certificate that is downloaded. The user is asked to trust the profile and, after they do that, the crooks can manage their device depending on the profile contents. As warned in the image below the crooks can potentially collect personal data, add/remove accounts, and install/manage apps.
In this instance, the crooks wanted victims to visit the website with their device’s browser again. When the site is visited after trusting the profile, the server prompts the user to install an app from a page that looks like Apple’s App Store, complete with fake reviews. The installed app is a fake version of the Bitfinex cryptocurrency trading application.
To avoid falling victim to these types of scams, iPhone users should only install apps from Apple’s App Store, the researchers suggested.
