Legit app stores offer apps that are part of pig butchering scams

Scammers have successfully infiltrated Google Play and the iOS App Store with applications that are part of pig butchering scams.

Researchers stated the apps had already been deleted from the official stores, but the malicious trading platform applications had already garnered thousands of downloads.

 

The pig butchering scams commonly utilise social engineering tactics to deceive users into providing money.

 

Based on reports, pig butchering is a malicious scheme in which the victim believes they are receiving investment returns on a fake trading platform that shows misleading information. Operators of such scams use social engineering to keep victims contributing money and prevent them from taking the alleged profit.

Researchers uncovered these fake trading platforms on the official app stores after a victim wanted to withdraw money that the fraudsters had already transferred to their accounts. The fake apps are suspected to be part of the “UniShadowTrade” malware family, which was discovered in May and constructed with the UniApp framework.

Some of the names of the confirmed pig butchering-related apps are SBI-INT (iOS), Finans Insights (Android), and Finans Trader6 (Android). The download count for the latter two has reached 5,000 times.

In addition, the researchers warned everyone that the UniShadow Trade apps can impersonate various legal crypto and trading platforms. The apps were also disguised as tools for “algebraic mathematical formulas and 3D graphics volume area calculations” on iOS and financial news feed aggregators on Android.

Once users install these apps, they are redirected to fake trading platforms that can only be accessed via invitation codes. In this instance, the attackers used social engineering tactics to groom their victims through conversations on dating apps.

The application demanded that users upload sensitive files, such as national IDs and passports, to legitimise the investment process and allow threat actors to obtain sensitive information. However, after the fake apps were removed from app stores in June, the threat actors transitioned their distribution strategy to phishing websites.

Users should be wary and knowledgeable about these schemes to avoid fraudulent investment scams. Lastly, users should be aware of unsolicited messages and URLs that promise “to-good-to-be-true” investment returns.