Pig-butchering scam apps sneak into Apples App Store and Google Play

CONFIDENCE SCAMS — Pig-butchering scam apps sneak into Apples App Store and Google Play In online confidence scams, appearance is everythingand app stores can help with that.

Dan Goodin – Feb 1, 2023 11:00 am UTC EnlargeAurich Lawson | Getty Images reader comments 6 with 0 posters participating Share this story Share on Facebook Share on Twitter Share on Reddit

In the past year, a new term has arisen to describe an online scam raking in millions, if not billions, of dollars per year. Its called “pig butchering,” and now even Apple is getting fooled into participating.

Researchers from security firm Sophos said on Wednesday that they uncovered two apps available in the App Store that were part of an elaborate network of tools used to dupe people into putting large sums of money into fake investment scams. At least one of those apps also made it into Google Play, but that market is notorious for the number of malicious apps that bypass Google vetting. Sophos said this was the first it had seen such apps in the App Store and that a previous app identified in these types of scams was a legitimate one that was later exploited by bad actors

Pig butchering relies on a rich combination of apps, websites, web hosts, and humansin some cases human trafficking victimsto build trust with a mark over a period of weeks or months, often under the guise of a romantic interest, financial advisor, or successful investor. Eventually, the online discussion will turn to investments, usually involving cryptocurrency, that the scammer claims to have earned huge sums of money from. The scammer then invites the victim to participate.

Once a mark deposits money, the scammers will initially allow them to make withdrawals. The scammers eventually lock the account and claim they need a deposit of as much as 20 percent of their balance to get it back. Even when the deposit is paid, the money isnt returned, and the scammers invent new reasons the victim should send more money. The pig-butchering term derives from a farmer fattening up a hog months before its butchered.

Advertisement Abusing trust in the App Store

Sophos said that it recently found two iOS listings in the App Store that were used for CryptoRom, a type of pig butchering that uses romantic overtures to build the confidence of its victims. The first was called Ace Pro and claimed to be an app for scanning QR codes. Enlarge / Ace Pro, as it appeared in the App Store before being removed.

The second app was MBM_BitScan, which billed itself as a real-time data tracker for cryptocurrencies. One victim Sophos tracked dumped about $4,000 into the app before realizing it was fake. Enlarge / MBM-BitScan as it appeared in the App Store before being removed.

Apple is famous for its reputationwarranted or otherwisefor filtering out malicious apps before they end up in the App Store. Combined with detailed fake online profiles and elaborate backstories the scammers use to lure victims, the presence of the apps in the App Store made the ruse all the more convincing.

If criminals can get past these checks, they have the potential to reach millions of devices, Sophos researchers wrote. This is what makes it more dangerous for CryptoRom victims, as most of those targets are more likely to trust the source if it comes from the official Apple App Store.

Apple representatives didnt respond to an email requesting an interview for this story. Google PR also declined an interview but said in an email the company removed the app after receiving a heads-up from Sophos.

Advertisement

Ace Pro and MBM_BitScan circumvented Apples vetting process by using remote content downloaded from hardcoded web addresses to deliver their malicious functionality. When Apple was reviewing the apps, the sites likely delivered benign content. Eventually, that changed.

Ace Pro, for instance, started sending a request to the domain rest.apizza[.]net, which would then respond with content from acedealex[.]xyz, which would deliver the fake trading interface. MBN_BitScan reached out to a server hosted by Amazon, which in turn beckoned flyerbit8[.]com, a domain designed to look like the legitimate Bitcoin service bitFlyer.

The process looked something like this: Enlarge / Diagram showing how app submissions bypassed vetting.

The fake interface gave the appearance of allowing users to deposit and withdraw money and field customer service requests in real time. To get the victims started, the scammers instructed them to transfer money into the Binance exchange and, from there, from Binance to the fake app.

Enlarge / Fake trading interface provided by Ace Pro.
Fake trading interface provided by MBM_BitScan. Page: 1 2 Next → reader comments 6 with 0 posters participating Share this story Share on Facebook Share on Twitter Share on Reddit Dan Goodin Dan is the Security Editor at Ars Technica, which he joined in 2012 after working for The Register, the Associated Press, Bloomberg News, and other publications. Find him on Mastodon at: https://infosec.exchange/@dangoodin Email dan.goodin@arstechnica.com Advertisement Channel Ars Technica ← Previous story Next story → Related Stories Today on Ars