Crypto Pig Butchering Scam 2023 : Crypto scam apps infiltrate Google Play and Apple App Store
Operators of high-yielding cryptocurrency investment scams known as ” Crypto pig butchering scams” have discovered a way to bypass Google Play and Apple’s App Store securities.
Pig butchering scams have been around for a while. They employ phishing websites, malicious advertising, and social engineering. The Crypto Pig butchering Scammers can gain a victim’s trust more easily by adding fraudulent apps to official download platforms.
According to Sophos researchers, scammers are targeting victims on Facebook or Tinder and convincing them to download the fraudulent apps and “invest” large sums of money in assets that appear to be real.
Sophos discovered such a campaign from the China-based threat group “ShaZhuPan,” which demonstrates high organisational levels with distinct teams handling victim interaction, finance, franchise, and money laundering.
Modus Operandi of Crypto Pig Butchering Scams
The Crypto Pig Butchering Scam appears to target male users on Facebook and Tinder by using stolen images from other social media accounts on women’s profiles.
The Crypto Pig Butchering Scammers’ profiles are designed to portray a lavish lifestyle, with photos of high-end restaurants, expensive shops, and exotic locations.
After gaining the victims’ trust, the scammers claim to have an uncle who works for a financial analysis firm and launch an invitation to trade cryptocurrency through an app on the Google Play or Apple App Store. The victim is obviously directed to a bogus app.
The scammer walk the victim through their first investment, instructing them to make a deposit on the legitimate cryptocurrency exchange platform Binance and then transfer the funds to the bogus app.
Crypto Pig Butchering Scam Apps
Sophos identified the malicious apps used in the campaign as “Ace Pro” and “MBM BitScan” on the Apple App Store and “BitScan” on the Google Play Store.
The apps initially allow the victim to withdraw small amounts of cryptocurrency before locking their accounts when larger amounts are involved. However, the initial withdrawal is sufficient to convince victims to continue investing in the scheme.
The method for circumventing security checks in mobile app stores is quite simple. To gain access to the App Store, the ShaZhuPan gang submits an app signed with a valid Apple certificate, which is required for any code to be accepted into the iOS repository.
Until the app receives approval, it connects to a harmless server and behaves normally. When the app passes the review, the developer changes the domain and connects to a malicious server.
The victim sees a cryptocurrency trading interface delivered from the malicious server after launching the app. Except for the user’s deposit, everything displayed is a hoax.
Researchers from Sophos discovered that the BitScan apps for Android and iOS use different vendor names but communicate with the same command and control server, which is hosted on a domain that appears to impersonate bitFlyer, a legitimate cryptocurrency exchange company in Japan.
Since these apps are only downloaded by a small number of targeted users, they are not widely reported for fraud, making it difficult for app store security reviewers to identify and remove them as fraudulent.
Final Thoughts
Scammers are motivated to put in the time and effort to gain the trust of their victims through extensive communication but Crypto pig butchering scams yield high profits in a short period of time.
The victim’s ability to see through the scam is hampered by the lengthy engagement, the initial withdrawal, and the convincing interface in the fake apps.
According to Sophos, the rise of “FinTech” has normalised people’s trust in these software tools, and when the Crypto pig butchering scam apps are found in official Apple and Google stores, the sense of legitimacy is enhanced.
Before installing any app on your smartphone, it is recommended that you read user reviews, review the privacy policy, learn about the developer/publisher, and research the company.
Wisdom Ganga is a Blogging Site that Aims to Make People Aware of Online Scam and other Digital Knowledge. Scam Topics are very sensitive issues that have taken the shape of Crime. The majority of people are not aware of such things. Please help us to make people aware of Scam and Cyber Crime by sharing this knowledge and article with others. Also Help Us by following us on Instgram, Facebook and Twitter.
Our team at Wisdomganga is constantly working to recognize all the possible scams and is focused on making everyone aware of them. If you find this article useful then you can now order a cup of coffee for our team as a token of appreciation.