Threat Intel
Fraudulent Trading Apps Targeting iOS and Android via UniApp Framework
Group‑IB uncovered a large‑scale fraud campaign that distributed counterfeit trading applications on iOS and Android. The malicious apps were published through official app stores and phishing sites using the UniApp framework. Defenders should verify app authenticity, monitor for duplicate app listings, and block associated domains.
What happened
Group‑IB investigators identified a coordinated effort to distribute counterfeit trading applications on both iOS and Android platforms. The attackers used the UniApp framework to bundle malicious code and published the apps under legitimate‑sounding names in official app stores and on phishing sites.
Impact
Users who installed the fake apps risked credential theft, unauthorized trades, and financial loss. The campaigns targeted multiple regions, exploiting the trust users place in official app stores.
What to do
- Verify the developer name and app ID against the official store listing.
- Check the app’s digital signature and compare it with the publisher’s known certificates.
- Use mobile device management (MDM) or endpoint protection to block installation of unverified apps.
- Block domains and URLs identified by threat‑intel feeds that host phishing sites or serve the malicious binaries.
- Educate users to download trading apps only from trusted sources and to verify in‑app permissions.
Mitigation steps
Deploy app‑store monitoring tools that flag duplicate or suspicious listings. Integrate threat‑intel feeds to automatically quarantine devices that have installed the identified binaries. Conduct regular security awareness training focused on mobile app fraud.
Related articles
Pegasus Zero‑Click Spyware: Detection and Mitigation for iOS and Android
Pegasus has been infecting mobile devices via zero‑click exploits, silently collecting messages, calls, location and audio. The threat remains active on both iOS and Android. Defenders should verify device integrity, monitor for abnormal data exfiltration, and apply vendor‑specific hardening steps.
Read briefing
Corp MDM Android Spyware Targets Logistics Sector via Fake Google Play Pages
A targeted campaign is distributing Android spyware known as Corp MDM via fraudulent Google Play landing pages impersonating logistics brands. The malware, packaged as a system service, is designed to intercept inbound SMS traffic, manipulate call routing, and maintain persistent background execution using a hard-coded command-and-control infrastructure.
Read briefing
Android RAT Hirudo Replaces Banking Apps with Trojanized Copies
A new Android RAT, Hirudo, drops trojanized copies of banking apps to bypass security controls, targeting eight Indonesian banks and potentially others. Defenders should block suspicious app downloads, monitor for unknown RATs, and enforce app vetting.
Read briefing
Hirudo Android Trojan Replaces Banking Apps with Patched Versions to Evade Security Checks
A new Android banking trojan, Hirudo, replaces legitimate banking apps with custom patched copies that bypass in‑app integrity and signature checks. The malware, delivered via popular dropper apps, steals credentials, takes device control, and captures screens, cameras, and SMS. Defenders should audit banking app integrity, block suspicious in‑app updates, and monitor for unauthorized accessibility services.
Read briefing