dailyhodl.com
Cyber security company Sophos says that iPhone users should be on the lookout for a new type of crypto scam emerging on the Apple App Store.
Sophos says the scam dubbed CryptoRom entices potential victims into installing fake crypto trading apps. The scammers initially approach their victims on dating platforms.
“Victims are contacted through dating sites or apps like Bumble, Tinder, Facebook dating and Grindr. They move the conversation to messaging apps. Once the victim becomes familiar, they ask them to install fake trading applications with legitimate-looking domains and customer support. They move the conversation to investment and ask them to invest a small amount, and even let them withdraw that money with profit as bait.
After this, they will be told to buy various financial products or asked to invest in special ‘profitable’ trading events. The new friend even lends some money into the fake app, to make the victim believe they’re real and caring. When the victim wants their money back or gets suspicious, they get locked out of the account.”
According to Sophos, iPhone users are the prime targets as the bad actors assume that they are “likely to be wealthy.”
“In our initial research, we discovered that the crooks behind these applications were targeting iOS users using Apple’s ad hoc distribution method, through distribution operations known as ‘Super Signature services.’
As we expanded our search based on user-provided data and additional threat hunting, we also witnessed malicious apps tied to these scams on iOS leveraging configuration profiles that abuse Apple’s Enterprise Signature distribution scheme to target victims.”
Sophos estimates that the scammers could so far have made millions of dollars in crypto since the fraudulent scheme started.
“One of the victims shared the Bitcoin address to which they transferred their money, and when we checked at the time of writing, it has sent over $1.39 million dollars to date. This shows the scale of this scam and how much money fraudsters are making from vulnerable users. This is just one Bitcoin address, the tip of the iceberg. There could be several, with millions being lost.”