GoldPickaxe Mobile Malware Steals from Both Android and iOS Devices

GoldFactory, a threat actor fluent in Chinese, is credited with developing advanced banking trojans, including a previously unreported iOS malware named GoldPickaxe. This malicious software is adept at extracting identity documents, facial recognition data, and intercepting SMS. The GoldPickaxe family is compatible with both iOS and Android platforms, and GoldFactory, identified as a well-organized Chinese-speaking cybercrime group, is believed to have close ties to Gigabud.

Active since at least mid-2023, GoldFactory is also accountable for an Android-based banking malware known as GoldDigger and its advanced version GoldDiggerPlus, along with GoldKefu, an embedded trojan within GoldDiggerPlus.

The malware is distributed through social engineering campaigns targeting the Asia-Pacific region, particularly Thailand and Vietnam. The attackers employ smishing and phishing messages, directing victims to switch to instant messaging apps like LINE, followed by sending deceptive URLs leading to the installation of GoldPickaxe. For Android, some malicious apps are hosted on fake websites resembling Google Play Store pages or counterfeit corporate sites.

iOS Variant Distributed Through Malicious URLs

GoldPickaxe for iOS follows a distinct distribution strategy, utilizing Apple's TestFlight platform and booby-trapped URLs prompting users to download a Mobile Device Management (MDM) profile, granting complete control over iOS devices for the installation of the rogue app.

The sophistication of GoldPickaxe is evident in its ability to circumvent security measures implemented by Thailand, which mandate users to confirm larger transactions using facial recognition to prevent fraud. GoldPickaxe prompts victims to record a video for confirmation within the fake application, utilizing these videos as raw material for creating deepfake videos through face-swapping AI services.

Both the Android and iOS variants of the malware are capable of collecting ID documents and photos, intercepting SMS messages, and proxying traffic through compromised devices. There are suspicions that GoldFactory actors use their own devices to sign in to bank applications and execute unauthorized fund transfers. These propagation mechanisms were disclosed by the Thailand Banking Sector CERT (TB-CERT) and the Cyber Crime Investigation Bureau (CCIB) in November 2023.