Check Point Research, an IT security firm, has uncovered a cryptocurrency wallet draining application that used “advanced evasion techniques” on the Google Play store to steal over $70,000 in five months.
How the App Worked
The malicious application disguised itself as the WalletConnect protocol, a well-known app in the crypto space that allows linking various crypto wallets to decentralized finance (DeFi) applications.
The company stated in a blog post dated September 26 that this marks the first instance where drainers exclusively targeted mobile users. Fake reviews and consistent branding helped the app achieve over 10,000 downloads by ranking high in search results. The app was made available on Google’s app store on March 21 and used advanced evasion techniques to remain undetected for over five months. Published initially under the name 'Mestox Calculator,' the app underwent several name changes while its application URL still pointed to a seemingly harmless website featuring a calculator. This technique allowed attackers to pass the app review process in Google Play, as automated and manual checks would load the 'harmless' calculator application. However, depending on the user's IP address location and mobile device usage, they were redirected to the malicious back end hosting the wallet-draining software MS Drainer.
Impact on Users
More than 150 users were drained of around $70,000. Not all users were targeted, as some did not connect a wallet or realized it was a scam. Others might not have met the malware’s specific targeting criteria.
The faked WalletConnect app prompted users to connect a wallet, which wouldn’t have been suspicious due to how the actual app functions. Users were then asked to accept various permissions to 'verify their wallet,' which granted permission for the attacker's address to transfer the maximum amount of the specified asset. The application retrieved the value of all assets in the victim's wallets, initially attempting to withdraw the more expensive tokens followed by cheaper ones.
Safety Recommendations
Check Point Research emphasizes the necessity of being cautious when downloading applications, even when they appear legitimate, and recommends that app stores improve their verification processes to prevent malicious apps. Researchers also noted that the crypto community must continue to educate users about the risks associated with Web3 technologies. This case illustrates that even seemingly innocuous interactions can lead to significant financial losses.
The malicious application has been removed from Google Play, but the incident highlights the need for increased scrutiny of applications and raised awareness of cybersecurity threats in the crypto sphere.
