GoldDigger: The New Threat on the Block
In a startling revelation, Group-IB, a global leader in cybersecurity, has unearthed a new Android Trojan named GoldDigger. This malicious software specifically targets users of over 50 Vietnamese banking, electronic wallets, and cryptocurrency applications. Its primary objective? To siphon off their funds.
Deceptive Disguise
GoldDigger, active since June 2023, cunningly masquerades as a Vietnamese government portal and a local energy company. It leverages the Android Accessibility service, a feature intended to assist users with disabilities. By exploiting this service, the Trojan gains the ability to extract personal information, intercept SMS messages, and even mimic user actions.
Group-IB’s vigilant Threat Intelligence unit first spotted the Trojan in June. Their investigation led them to over ten counterfeit websites, eerily resembling Google Play Store pages and legitimate company sites. These decoy sites, some even flaunting user reviews and the emblem of Vietnam, are meticulously crafted to trick users into downloading the perilous GoldDigger application.
The Trojan’s Modus Operandi
Once installed and initiated, GoldDigger prompts users for access to the Accessibility Service. Unsuspecting users, granting this access, inadvertently empower the Trojan to monitor and manipulate their device’s functionalities. This Trojan keeps a close watch on events linked to 51 specific applications associated with Vietnamese financial institutions, e-wallets, and cryptocurrency apps. Upon capturing sensitive user data, such as login credentials, GoldDigger swiftly transfers this information to its command-and-control servers.
A unique aspect of GoldDigger is its use of Virbox Protector, a legitimate software known for advanced obfuscation and encryption. This tool is employed by malware creators to hinder cybersecurity experts from analyzing and reverse-engineering their malevolent code, thereby evading detection by standard anti-fraud solutions.
However, Group-IB’s Fraud Protection stands as a formidable opponent, capable of effectively detecting GoldDigger.
Also read: Idris Elba Delves Deep into the World of Gold in New Exclusive Documentary
A Potential Global Threat
Anh Le, Group-IB’s Business Development Manager in Vietnam, shared, “At the moment, GoldDigger is primarily focusing on targets in Vietnam. However, Group-IB’s Threat Intelligence team found that, in addition to Vietnamese, the malware included language translations to Spanish and traditional Chinese. The cybercriminals may have plans to further extend GoldDigger’s reach to Spanish and Chinese-speaking countries in the near future. We continue the investigation into GoldDigger and will provide updates when they become available.”
Protecting Yourself from Trojan GoldDigger
To minimize their risk of downloading banking Trojans such as GoldDigger, Group-IB recommends users always check for updates on their mobile devices, avoid downloading applications from sources outside of the Google Play Store, and check what permissions an application requests once it is downloaded. Companies aiming to shield their users from malware onslaughts should consider Group-IB’s Fraud Protection solution. It scrutinizes user sessions using advanced machine learning algorithms to pinpoint suspicious behavior, the latest fraud techniques, unauthorized remote sessions, and the presence of malware, such as GoldDigger.
