Deceptive Cryptocurrency Application Posed as WalletConnect Swipes $70,000 in Five-Month Operation
Cybersecurity experts have stumbled upon a malevolent Android application on the Google Play Store that enabled the cybercriminals behind it to pilfer approximately $70,000 in digital currency from victims over a span of almost five months.
The shady application, uncovered by Check Point, impersonated the bona fide WalletConnect open-source protocol to deceive unsuspecting users into downloading it.
“By leveraging fabricated reviews and a consistent brand image, the application managed to amass over 10,000 downloads by securing a high spot in search results,” the cybersecurity firm mentioned in an examination, marking the first instance of a digital currency drainer explicitly targeting mobile device users.
An estimated 150+ users are thought to have been ensnared by the scheme, although it’s speculated that not every individual who downloaded the application fell prey to the digital currency drainer.
The operation entailed the dissemination of a deceitful application that went by multiple monikers such as “Mestox Calculator,” “WalletConnect – DeFi & NFTs,” and “WalletConnect – Airdrop Wallet” (co.median.android.rxqnqb).
Although the application is no longer accessible for download from the official app store, data from SensorTower indicates that it found popularity in Nigeria, Portugal, and Ukraine, and was associated with a developer named UNS LIS.
The developer has also been linked to another Android application dubbed “Uniswap DeFI” (com.lis.uniswapconverter) that remained active on the Play Store for approximately a month between May and June 2023. It is currently unclear if this application harbored any malevolent functionalities.
Nonetheless, both applications can be acquired from third-party sources, underscoring once again the hazards associated with downloading APK files from alternative platforms.
Upon installation, the bogus WallConnect application is programmed to steer users towards a phony website based on their IP address and User-Agent string, redirecting them a second time to a different site imitating Web3Inbox if the conditions are met.
Individuals failing to meet the specified criteria, such as those accessing the URL from a desktop browser, are redirected to a legitimate site to avoid detection, effectively enabling the cybercriminals to circumvent the application review process on the Play Store.
In addition to implementing measures to deter analysis and debugging, the core element of the malware is a digital currency drainer dubbed MS Drainer, which coerces users to connect their wallet and authorize multiple transactions to validate their wallet.
The information inputted by the victim at each stage is transmitted to a command-and-control server (cakeserver[.]online) which subsequently responds with instructions to execute malicious transactions on the device and transfer the funds to an address controlled by the attackers.
“Similar to the theft of native cryptocurrency, the deceptive application initially deceives the user into endorsing a transaction in their wallet,” clarified Check Point researchers.
“Through this transaction, the victim grants permission for the attacker’s address 0xf721d710e7C27323CC0AeE847bA01147b0fb8dBF (the ‘Address’ field in the configuration) to transfer the maximum amount of the specified asset (if allowed by its smart contract).”
In the subsequent step, the tokens from the victim’s wallet are transferred to a separate wallet (0xfac247a19Cc49dbA87130336d3fd8dc8b6b944e1) controlled by the adversaries.
This also implies that unless the victim revokes the authorization to withdraw tokens from their wallet, the adversaries can repeatedly siphon off the digital assets as soon as they become available without any further action required.
Check Point disclosed the identification of another malicious application showing identical characteristics “Walletconnect | Web3Inbox” (co.median.android.kaebpq) that was previously present on the Google Play Store in February 2024, accruing over 5,000 downloads.
“This occurrence underscores the increasing complexity of cybercriminal strategies, specifically in the domain of decentralized finance, where users typically depend on third-party utilities and protocols to oversee their digital assets,” the company acknowledged.
“The deceitful application did not rely on conventional attack methods like permissions or keylogging; instead, it employed smart contracts and deep links to quietly drain assets once users were enticed to use the application.”
About Author
