Tinder and Bumble users targeted by major iOS crypto scam
The scam could cause victims to lose more than just their cryptos
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Cybersecurityresearchers have shared insights into acryptocurrencytrading scam that attacksiPhoneusers throughpopular dating platformssuch as Bumble and Tinder.
Named CryptRom by researchers atSophos, the scam first targeted people in Asia, and is now attacking users in the US and Europe as well.
ABitcoin walletbelonging to the attackers reveals that the threat actors have minted nearly $1.4 million in cryptos from the scam.
We’re looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won’t take more than 60 seconds of your time, and we’d hugely appreciate if you’d share your experiences with us.
Click here to start the survey in a new window«
“The CryptoRom scam relies heavily on social engineering at almost every stage,” said Jagadeesh Chandraiah, senior threat researcher at Sophos, adding that the novel scam has the potential of doing a lot more damage than just stealing cryptos.
Gateway to scams
Unraveling the scam, Sophos says the threat actors begin by posting fake profiles on legitimate dating sites to lure in victims. Once baited, the victims are then persuaded to install and invest in a fake cryptocurrency trading app.
“At first, the returns look very good but if the victim asks for their money back or tries to access the funds, they are refused and the money is lost,” the researchers share.
The threats however don’t just end with the lost cryptos. Sophos notes that the threat actors useApple’s enterprise signature mechanism to install apps directly oniOS devicescircumventing theApp Store.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Enterprise signature is designed for use by iOS developers to enable app developers to testiOS appsbefore submitting them to the official Apple App Store for review and approval.
“Until recently, the criminal operators mainly distributed the fake crypto apps through fake websites that resemble a trusted bank or the Apple App Store. The addition of the iOS enterprise developer system introduces further risk for victims because they could be handing the attackers the rights to their device and the ability to steal their personal data,” said Jagadeesh Chandraiah, senior threat researcher at Sophos.
Sophos believes the threat actors use the fake crypto trading app to gain remote management control over the devices of their victims, which exposes them to all kinds of malicious campaigns.
With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’sTechRadar Pro’sexpert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.
Washington state court systems taken offline following cyberattack
Is it still worth using Proton VPN Free?
Target kicks off its Black Friday sale with deals on TVs, toys, iPads, air fryers and more
