A new iOS and Android trojan named 'GoldPickaxe' employs a social engineering scheme to trick victims into scanning their faces and ID documents, which are believed to be used to generate deepfakes for unauthorized banking access.
The new malware, spotted by Group-IB, is part of a malware suite developed by the Chinese threat group known as 'GoldFactory,' which is responsible for other malware strains such as 'GoldDigger', 'GoldDiggerPlus,' and 'GoldKefu.'
Group-IB says its analysts observed attacks primarily targeting the Asia-Pacific region, mainly Thailand and Vietnam. However, the techniques employed could be effective globally, and there's a danger of them getting adopted by other malware strains.
Starts with social engineering attacks
The distribution of Gold Pickaxe started in October 2023 and is still ongoing. It is considered part of a GoldFactory campaign that began in June 2023 with Gold Digger.
![Campaign timeline](https://www.bleepstatic.com/images/news/u/1220909/2024/Apple/04/campaign.png)
Victims are approached through phishing or smishing messages on the LINE app that are written in their local language, impersonating government authorities or services.
The messages attempt to trick them into installing fraudulent apps, such as a fake 'Digital Pension' app hosted on websites impersonating Google Play.
![Malicious app hosted on a fake Google Play website](https://www.bleepstatic.com/images/news/u/1220909/2024/Apple/04/fake-app.png)
Source: Group-IB
For iOS (iPhone) users, the threat actors initially directed targets to a TestFlight URL to install the malicious app, allowing them to bypass the normal security review process.
When Apple remove the TestFlight app, the attackers switched to luring targets into downloading a malicious Mobile Device Management (MDM) profile that allows the threat actors to take control over devices.
![iOS infection chain](https://www.bleepstatic.com/images/news/u/1220909/2024/Apple/04/ios-infect.png)
Source: Group-IB
Gold Pickaxe capabilities
Once the trojan has been installed onto a mobile device in the form of a fake government app, it operates semi-autonomously, manipulating functions in the background, capturing the victim's face, intercepting incoming SMS, requesting ID documents, and proxying network traffic through the infected device using 'MicroSocks.'
On iOS devices, the malware establishes a web socket channel to receive the following commands:
- Heartbeat: ping command and control (C2) server
- init: send device information to the C2
- upload_idcard: request the victim to take an image of their ID card
- face: request the victim to take a video of their face
- upgrade: display bogus “device in use” message to prevent interruptions
- album: sync photo library date (exfiltrate to a cloud bucket)
- again_upload: retry exfiltration of victim's face video to the bucket
- destroy: stop the trojan
The results of executing the above commands are communicated back to the C2 via HTTP requests.
![Possible fraud strategy](https://www.bleepstatic.com/images/news/u/1220909/2024/Apple/04/poss-strat.png)
Source: Group-IB
Group-IB says the Android version of the trojan performs more malicious activities than in iOS due to Apple's higher security restrictions. Also, on Android, the trojan uses over 20 different bogus apps as cover.
For example, GoldPickaxe can also run commands on Android to access SMS, navigate the filesystem, perform clicks on the screen, upload the 100 most recent photos from the victim's album, download and install additional packages, and serve fake notifications.
![Face capturing interface](https://www.bleepstatic.com/images/news/u/1220909/2024/Apple/04/face-capture.png)
Source: Group-IB
The use of the victims' faces for bank fraud is an assumption by Group-IB, also corroborated by the Thai police, based on the fact that many financial institutes added biometric checks last year for transactions above a certain amount.
It is essential to clarify that while GoldPickaxe can steal images from iOS and Android phones showing the victim's face and trick the users into disclosing their face on video through social engineering, the malware does not hijack Face ID data or exploit any vulnerability on the two mobile OSes.
Biometric data stored on the devices' secure enclaves is still appropriately encrypted and completely isolated from running apps.
Update 2/16 - A Google spokesperson sent BleepingComputer the following comment regarding the GoldPickaxe threat:
Android users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services.
Google Play Protect can warn users or block apps known to exhibit malicious behavior, even when those apps come from sources outside of Play.
Comments
electrolite - 2 weeks ago
This is why using bio metrics for authentication is such a bad idea from the beginning. If they have your face, what are you going to do, get a face transplant? How about new finger prints (for android phones anyway)? Tech companies just need to stick to hash tokens that can be easily swapped out if needed.
U_Swimf - 2 weeks ago
Anddd this is why i keep tape over my cameras... Unfortunately there's about 10000 other things that bug me more which i cant solve with tape.. Like ODMs packaging their SMS/MMS apps with Activities and Providers named stupid stuff like, Hijack.interceptor.mms... no BS. The other day my phone had "Welcome to your Never Settle World" instead of just Never Settle, posted in the devices Settings App. Suddenly it's gone now too. just gonna start ignoring it