Cybersecurity researchers from McAfee have uncovered hundreds of malicious Android apps designed to steal access to people’s cryptocurrency wallets.
The researchers dubbed the campaign SpyAgent, which was made up of 280 apps in total, so far, mimicking legitimate banking apps, government services tools, TV streaming, utilities apps, and more. The criminals would host then these on malicious sites and third-party app stores (never on Google Play Store), and look to trick victims into installing them via phishing, social messaging apps, and similar.
When the victim installed the app, the malware would scour through images saved on the device and use optical character recognition (OCR) to scan the contents of the files. If it finds anything useful (for example, words), it would exfiltrate the contents to a cloud-hosted database, where the attackers would grab it.
Mnemonic keys and seed phrases
Most cryptocurrency wallets have two layers of protection. One is a password, a PIN code, or biometrics, which is stored on the device and allows the user to access and operate the wallet. The other is the so-called “mnemonic key”, or “seed phrase” – a set of 12 or 24 random words, which allow the user to load the contents of the wallet into a new device. The mnemonic key is a backup option of sorts. If a user loses access to their phone, or hardware wallet, they can get a new one, load the seed phrase, and regain access to their wallets and all the currency found inside.
However, if a malicious actor gets their hands on the mnemonic key they, too, can load the wallet and easily empty it. Since many people use “hot wallets” (mobile apps, basically), they also store their mnemonic keys as screenshots on their phones.
The best way to protect against these apps is to only download them from vetted sources, such as the Google Play Store. For more details on malicious apps, check out McAfee’s report here.
