Crypto mining scams targeting tens of thousands of victims using hundreds of android apps

Lookout, Inc. announced the discovery of major crypto mining scams using hundreds of Android apps. Categorized into two distinct Android app families, BitScam and CloudScam, these apps were designed to target people interested in cryptocurrencies. In total, security researchers at the Lookout Threat Lab identified more than 170 apps that are estimated to have scammed more than 93,000 victims. The majority of these apps are side loaded based on the fact that only 25 were available for download on Google Play. Lookout has been in close contact with Google and the apps on Play have been removed.

BitScam apps include (83,800 total):

Top Coins = 1,000
Mr Bitcoin = 1,000
Star BTC = 1,000
Bitcoin Burn = 1,000
Moon BAT = 1,000
Bito Holic = 10,000
Bito Hash = 50,000
BitHash = 10,000
Multi Coins = 1,000
BitcoinCash Miner = 100
Airdrop = 500
Bright Miner = 1,000
Pink BTC = 0 (was brand new when discovered)
XMR Miner = 500
COIN Master = 5,000
ETHMINER PRO = 100
crypto cloud mining pro = 100
Btc Miner pro = 500

CloudScam apps include (9,600 total):

Bito Miner = 100
Mining Machine = 1,000
BTC CLOUD = 1,000
BTC Cash = 500
Black Crypto = 1,000
Cloud Mining = 5,000
Crypto Pro-Miner = 1,000

The BitScam and CloudScam apps advertise themselves as providing cloud cryptocurrency mining services for a fee. After analyzing the apps, Lookout researchers found that no cloud crypto mining actually takes place. The scammers pocket the money spent on apps and upgrades without ever delivering the promised services. Lookout estimated that the apps stole more than $350,000 from their victims.

“These apps were able to fly under the radar because they don’t actually do anything malicious,” said Ioannis Gasparis, a mobile application security researcher at Lookout. “They are simply shells set up to attract users caught up in the cryptocurrency craze and collect money for services that don’t exist. Purchasing goods or services online always requires a certain degree of trust — these scams prove that cryptocurrency is no exception.”

BitScam and CloudScam apps both trick people into thinking they are paying for cloud crypto mining services. In addition to the apps themselves costing money, they promote additional services and upgrades that users can purchase within the apps, either by transferring cryptocurrencies to the developers’ wallets or through Google Play. These apps also display fake minimum account balances to entice users to spend more money on the services and upgrades.

While the BitScam and CloudScam cryptomining apps have now been removed from Google Play, there are dozens more available for download on third-party app stores.

To learn more about BitScam and CloudScam, read the Lookout research blog or visit the Lookout Threat Lab.

In today's rapidly evolving security landscape, organizations face an ever-growing array of disruptive events, security threats and risks. Traditional reactive approaches to security intelligence often leave businesses vulnerable and ill-prepared to anticipate and mitigate emerging threats that could impact the safety of their people, facilities or operations.

ON DEMAND: Apple Mac computer use is growing in the corporate space. Having the solutions and the knowledge base to respond to events that include Mac computers is just as important as their Windows counterparts.