Malicious apps entering in mobile through Play Store & fake crypto wallets: ESET

A research found that many malicious apps are under circulation in the internet world, which are spoofing users through fake or copycat websites. 

Crypto and scam, both these two words are common things in this world because lack of understanding about crypto, results in some scams, for the majority of the new users in Crypto. However many bad actors are active in the internet world, which are using crypto-based payment to fool people and steal money. But here this latest report revealed something strange, that can’t be expected by even experienced crypto users.

Recently ESET, a cybersecurity firm, uncovered some strange types of malicious activities which can easily spoof users because these malicious things are available on the Google Play Store also. 

ESET report noted that many bad actors are active through spoof and fake websites and also in some cases, malicious apps were found available on Google Play Store. The majority of these malicious apps are using copycat names of popular crypto wallets like Coinbase, Metamask, Trust Wallet, TokenPocket, Bitpie, imToken, and OneKey.

This cybersecurity firm also discovered 13 malicious apps. One of them is the Jaxx Liberty wallet, which is available on the Play Store. However, this is not a Jaxx Liberty wallet but looks like a Jaxx Liberty Wallet.

However last year Google removed such 11,00 apps but still, there are few apps, which are active not only on Google Play Store but also at many third-party apps stores, which are available through internet websites. 

ESET report also claimed that such types of apps are active since May 2021 and the majority of them get promotions through social media platforms like Facebook, Telegram groups, etc. 

Lukáš Štefanko, the researcher who unraveled the scheme, said that such apps usually target the phrase seed of the wallet by using the secret of unsecured connections. 

“This means that victims‘ funds could be stolen not only by the operator of this scheme but also by a different attacker eavesdropping on the same network.”

Read also: UK’ FCA extended registration due for dozens of crypto companies