FB pixel

Cybercriminals use malware to obtain face biometrics, break into banking apps

Cybercriminals use malware to obtain face biometrics, break into banking apps

Chinese cybercrime group GoldFactory is creating malware to attack Android and iOS that steals face biometrics and uses them to break into bank accounts of the victim, according to The Register.

The group started releasing trojanized smartphone apps in June 2023. The first version, GoldDigger, focused on getting banking credentials. The latest version, GoldPickaxe or GoldPickaxe.iOS for Android and iOS, first appeared in October of that same year. It captures data used for identity verification, including face biometrics.

Bleeping Computer says that Group-IB, a team of researchers investigating the attacks, believes cybercriminals harvest biometric data that users provide for verification in the apps, then use it to log into accounts on legitimate banking apps in Vietnam and Thailand.

The iOS version is currently only known to be posing as the official digital pensions app for Thailand, though some believe it has also entered Vietnam. The Android version presented itself in the form of over 20 different government and finance related apps in Thailand.Android malware is more common due to sideloading capabilities. But the iOS app is more surprising, as Apple’s platform is recognized as more secure.

The iOS version leveraged Apple’s TestFlight platform, meant to distribute beta apps. Once Apple removed TestFlight, cybercriminals instead convinced iOS users to enroll their phones into a mobile device management program.

Initial contact was made with the victims by fraudsters posing as government authorities through the LINE messaging app, claiming to offer things such as pension benefits.

Victims were directed to download GoldPickaxe, where they shared face scans, which were then used to generate deepfake versions of their biometrics. Using a combination of deepfakes, stolen identity documents, and intercepted SMS messages, attackers gained access to victims’ bank accounts.

Thai banking apps have been required to replace one-time passcodes with face biometrics for transactions exceeding 50,000 BAT (roughly US$1,400) since the summer of 2023.

While GoldPickaxe can steal biometrics through social engineering, it is not hijacking Face ID or Android biometric data or exploiting any operating system vulnerabilities. Biometric data stored on devices remains secure and isolated from running apps.

Article Topics

 |   |   |   |   | 

Latest Biometrics News


U.S. academic institutions get biometric upgrades with new partnerships

A press release says ROC (formerly Rank One Computing), which provides U.S.-made biometrics and computer vision for military, law enforcement…


Smart Bangladesh 2041: Balancing ambition with reality

Bangladesh aims to be a “Smart” nation by 2041 as the country goes through a drastic transformation founded on digital identity…


Nigeria’s NIMC introducing one multi-purpose digital ID card, not three

The National Identity Management Commission of Nigeria (NIMC) has clarified that only one new digital ID card with multiple functions…


Age assurance tech is ready now, and international standards are on their way

The Global Age Assurance Standards Summit has wrapped up, culminating in a set of assertions, a seven-point call-to-action and four…


NIST finds biometric age estimation effective in first benchmark, coming soon

The U.S. National Institute of Standards and Technology presented a preview of its assessment of facial age estimation with selfie…


Maryland bill on police use of facial recognition is ‘strongest law in the nation’

Maryland has passed one of the more stringent laws governing the use of facial recognition technology by law enforcement in…


Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Most Read From This Week

Featured Company

Biometrics Insight, Opinion

Digital ID In-Depth

Biometrics White Papers

Biometrics Events