These fake iOS apps just want to trick you out of your crypto

Best Cloud Mining
(Image credit: André François McKenzie / Unsplash)

A known cryptocurrency fraud which leverages fake trading apps to trick people into giving away their hard-earned money made it past Apple’s strict security protocols and into its mobile app repository, researchers have warned. 

Apple has been alerted to the presence and quickly moved to eliminate the threats from the App Store - still, if you have downloaded these apps, make sure to remove them from your endpoints immediately.

Cybersecurity researchers from Sophos have detailed two apps designed for so-called CryptoRom fraud. This type of fraud is quite simple - a trickster would create a fake social media account, assuming the identity of a rich, attractive woman. Then, they’d reach out to potential victims and after a little back-and-forth, trick them into downloading the fake trading apps, under the promise of riches and wealth. 

Fake QR code scanners

People that would fall for the trick would think they’re making an investment, but would instead, just be parted with their money.

The two apps in question are called Ace Pro and MBM_BitScan, and what makes these two stand out from the crowd of other CryptoRom apps is the fact that they made it past Apple’s security and into the App Store. 

One of the apps managed to bypass the protections by posing as a QR code scanner connected to a benign-looking website, but after a while, the developers redirected it to a domain registered in Asia, which ultimately delivers the fake trading interface. 

The other app, MBM_BitScan, is also available on Google’s Play Store, where it’s known as BitScan. These two apps were observed communicating with the same Command and Control infrastructure (C2), which further communicates with a server posing as a legitimate Japanese crypto firm. Everything else is handled in the web interface, which is how the crooks managed to trick Google into allowing the app in the first place.

The best way to protect against such scams, the researchers are saying, is to use common sense, and if something looks like a scam, it most likely is. If an app can’t be found on a legitimate repository, or requires extra steps to be used, that should raise a red flag with the users. 

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
Android phone malware
Screen reading malware found in iOS app stores for first time - and it might steal your cryptocurrency
Smartphone with new logo X twitter app background. Application twitter old blue bird change X black and white new.
Phishing campaign targets prominent X users, accounts at risk
A close-up photo of an iPhone, with the App Store icon prominent in the center of the image.
App stores are increasingly becoming a major security worry
Man holding a mobile phone with warning notification and spam message icon
Scammers have a new phishing trick for iPhone users – here’s how to avoid falling victim
DeepSeek
Fake DeepSeek installers are infecting your device with dangerous malware
Malware worm
Coordinated global mobile malware campaign targets banking apps and cryptocurrency platforms
Latest in Security
Isometric demonstrating multi-factor authentication using a mobile device.
NCSC gets influencers to sing the praises of 2FA
Sam Altman and OpenAI
OpenAI is upping its bug bounty rewards as security worries rise
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Dangerous new CoffeeLoader malware executes on your GPU to get past security tools
China
Notorious Chinese hackers FamousSparrow allegedly target US financial firms
A digital representation of a lock
NYU website defaced as hacker leaks info on a million students
NHS
NHS IT supplier hit with major fine following ransomware attack
Latest in News
Nintendo Switch 2 Joy-Con up-close from app store
Nintendo's new app gave us another look at the Switch 2, and there's something different with the Joy-Con
cheap Nintendo Switch game deals sales
Nintendo didn't anticipate that Mario Kart 8 Deluxe was 'going to be the juggernaut' for the Nintendo Switch when it was ported to the console, according to former employees
Three angles of the Apple MacBook Air 15-inch M4 laptop above a desk
Apple MacBook Air 15-inch (M4) review roundup – should you buy Apple's new lightweight laptop?
Witchbrook
Witchbrook, the life-sim I've been waiting years for, finally has a release window and it's sooner than you think
Amazon Echo Smart Speaker
Amazon is experimenting with renaming Echo speakers to Alexa speakers, and it's about time
Shigeru Miyamoto presents Nintendo Today app
Nintendo Today smartphone app is out now on iOS and Android devices – and here's what it does