iPhone users ripped off at least $1.4 million through Bumble and Tinder scams

Threat actors have been targeting iPhone users through popular dating apps, such as Bumble and Tinder. The victims have lost at least $1.4 million to a scam aimed at US, European, and Asian users.

Cybersecurity company Sophos has released new insight on international cryptocurrency trading scam targeting iPhone users through popular dating apps. Researchers claim that attackers have expanded from targeting people in Asia to including users in the US and Europe.

The scam was first uncovered in May. Scammers used dating sites and apps to social engineer victims into installing fake cryptocurrency apps on iPhone and Android. At the time, evidence suggested that the crooks were exclusively targeting victims in Asia. But since then, researchers have seen increasing evidence of this being a wide-ranging global scam. In addition to the Asian countries, researchers found victims of similar scams from the UK, France, Hungary, and the US.

Researchers dubbed the threat CryptoRom and have uncovered a Bitcoin wallet controlled by the attackers that contains nearly $1.4 million in cryptocurrency, allegedly collected from victims.

"One of the victims shared the bitcoin address to which they transferred their money, and when we checked at the time of writing, it has been sent over $1.39 million to date. This shows the scale of this scam and how much money fraudsters are making from vulnerable users. This is just one bitcoin address, the tip of the iceberg. There could be several, with millions being lost," Sophos concluded.

Based on the victims researchers have come across, they claim that most have been iPhone users. The web pages created to distribute malicious cryptocurrency apps have been mainly mimicking the App store, suggesting that these scammers are targeting iPhone users, assuming they are likely to be wealthy.

"From news reports, we learned one victim lost £63000 (~ $87000). There are additional news reports in the UK of these scams, with one victim losing £35000 (~$45000) to a scammer who contacted them through Facebook, and another who lost £20000($25000) after being scammed by someone who contacted through Grindr. In the latter case, the victim made an initial deposit, transferred money to a Binance application from their bank and then to crooks; they were then asked to deposit more funds in order to withdraw their money. None of these victims have gotten their money back," Sophos research reads.

A senior threat researcher Jagadeesh Chandraiah claims that the CryptoRom scam relies heavily on social engineering at almost every stage.

First, the attackers post convincing fake profiles on legitimate dating sites. Once they've made contact with a target, the attackers suggest continuing the conversation on a messaging platform. They then try to persuade the target to install and invest in a fake cryptocurrency trading app. At first, the returns look very good, but if the victim asks for their money back or tries to access the funds, they are refused, and the money is lost. Our research shows that the attackers are making millions of dollars with this scam,

Jagadeesh Chandraiah explained.

Trouble doesn't end with victims losing their money, though. In addition to stealing money, the attackers can also gain access to victims' iPhones.

In this version of the attack, cybercriminals leverage "Enterprise Signature," a system for software developers that helps organizations pre-test new iOS applications with selected iPhone users before they submit them to the official Apple App Store for review and approval.

With the functionality of the Enterprise Signature system, attackers can target larger groups of iPhone users with their fake crypto-trading apps and gain remote management control over their devices. This means the attackers could potentially do more than just steal cryptocurrency investments from victims. They could also, for instance, collect personal data, add and remove accounts, and install and manage apps for other malicious purposes.

"Until recently, the criminal operators mainly distributed the fake crypto apps through fake websites that resemble a trusted bank or the Apple App Store," said Chandraiah. "The addition of the iOS enterprise developer system introduces further risk for victims because they could be handing the attackers the rights to their device and the ability to steal their personal data. To avoid falling victim to these types of scams, iPhone users should only install apps from Apple's App Store. The golden rule is that if something seems risky or too good to be true – such as someone you barely know telling you about some 'great' online investment scheme that will deliver a big profit – then sadly, it probably is."

In the first half of 2021, the FBI's Internet Crime Complaint Center (IC3) received over 1,800 complaints related to online scams that resulted in losses exceeding $130 million in the US alone.

More from CyberNews:

We've seen just the tip of the Mēris botnet iceberg

MLN, an Australian IT vendor, has its customer database leaked

Google warns 14,000 Gmail users: government-backed attackers may be trying to steal your password

Here are the worst bits of malware in 2021

What has the UK’s Weir Group cyber-attack taught us?

Subscribe to our newsletter