Cybercriminals use malware to obtain face biometrics, break into banking apps

Chinese cybercrime group GoldFactory is creating malware to attack Android and iOS that steals face biometrics and uses them to break into bank accounts of the victim, according to The Register.

The group started releasing trojanized smartphone apps in June 2023. The first version, GoldDigger, focused on getting banking credentials. The latest version, GoldPickaxe or GoldPickaxe.iOS for Android and iOS, first appeared in October of that same year. It captures data used for identity verification, including face biometrics.

Bleeping Computer says that Group-IB, a team of researchers investigating the attacks, believes cybercriminals harvest biometric data that users provide for verification in the apps, then use it to log into accounts on legitimate banking apps in Vietnam and Thailand.

The iOS version is currently only known to be posing as the official digital pensions app for Thailand, though some believe it has also entered Vietnam. The Android version presented itself in the form of over 20 different government and finance related apps in Thailand.Android malware is more common due to sideloading capabilities. But the iOS app is more surprising, as Apple’s platform is recognized as more secure.

The iOS version leveraged Apple’s TestFlight platform, meant to distribute beta apps. Once Apple removed TestFlight, cybercriminals instead convinced iOS users to enroll their phones into a mobile device management program.

Initial contact was made with the victims by fraudsters posing as government authorities through the LINE messaging app, claiming to offer things such as pension benefits.

Victims were directed to download GoldPickaxe, where they shared face scans, which were then used to generate deepfake versions of their biometrics. Using a combination of deepfakes, stolen identity documents, and intercepted SMS messages, attackers gained access to victims’ bank accounts.

Thai banking apps have been required to replace one-time passcodes with face biometrics for transactions exceeding 50,000 BAT (roughly US$1,400) since the summer of 2023.

While GoldPickaxe can steal biometrics through social engineering, it is not hijacking Face ID or Android biometric data or exploiting any operating system vulnerabilities. Biometric data stored on devices remains secure and isolated from running apps.

Article Topics

banking  |  biometrics  |  cybersecurity  |  deepfakes  |  face biometrics  |  malware