 |
Hi Reader,
Why this Alert?
A new malware has been discovered – and it’s a bad one!
It is called GoldPickaxe.iOS by Group-IB and is a sophisticated mobile Trojan that steals information from both Android and iOS users.
It is capable of collecting facial recognition data, identity documents, and intercepting SMS.
The threat actor then uses the stolen biometric data by utilizing AI face-swapping services to create deepfakes which allows them access to the victim’s bank accounts.
My thoughts:
The big question that was bothering me was why the bit about “deepfake face-swapping”…
Turns out that The Bank of Thailand changed its system to no longer use OTP (SMS One-Time Pins) when a customer requests certain transactions to be done. Now these transactions must be done with facial biometric verification.
The threat actor creates a deepfake video using the info that was stolen from the victim’s phone!
For now, this seems like it is a “test run” of the malware just in Thailand and Vietnam. However, we can expect it to be exported and used in more countries.
What worries me is the number of banks that are testing the exact same system!
How does this impact you as a Creator?
Part of the personal data that is removed from your phone will authenticaion tokens which, as I showed you in the YouTube Security Course, is how hackers bypass your 2-factor authentication and access your YouTube channel.
What is concerning is the alarming rate at which Hackers are evolving thanks to AI…
What should you do?
This malware is spreading on iOS devices via something called TestFlight. This is a legit way made by Apple for app developers to test their apps without going through the App Store.
Be on the lookout for anything that is related to TestFlight.
Treat any invitation by brands or agencies that require you to sign up for their system with suspicion.
DO NOT sign up for any system you don’t recognize or at least research. If you must sign up, always sign up directly via the website and never through a link that could redirect you to another website without your knowledge.
Want to know more?
Read the full technical breakdown here
Keep safe out there,
Liron Segev
Start here to secure your YouTube channel from hackers!
