A malicious application found by a cybersecurity firm on Google Play was stealing cryptocurrency. What made this particular application more dangerous is that it flew below the radar for more than 5 months before being removed.
The application, known as WalletConnect- Airdrop Wallet, was uploaded in March 2024 targeting Android users, according to a case study done by Check Point Research on crypto drainer apps.
The fake app managed to evade radar by disguising itself as a legitimate tool for Web3 apps. The app exploited one of the most popular WalletConnect protocols, which is widely used to connect cryptocurrency wallets to dApps.
Hackers, therefore, leveraged the reputation of WalletConnect and created a fake app that looked trustworthy to unsuspecting users.
This is not the first time hackers used the reputation of a known company for crypto phishing attacks. In recent news, the legitimate OpenAI X account, @OpenAINewsroom was hacked. The hackers managed to deceive approximately 54,000 followers with a phishing message proclaiming the recently launched cryptocurrency token, $OPENAI. Read more
During its availability on the Google Play store, the crypto drainer app succeeded in stealing about US$70,000 (approximately 58.6 lakh) worth of crypto from victims.
According to Check Point Research’s case study, the application was downloaded more than 10,000 times.
It was hard to identify the application since the fake positive reviews posted by hackers outnumbered the negative reviews posted by the victims. Over 20 users who suffered financial loss left negative comments. Fake positive reviews also made the application look authentic, thereby boosting the number of its downloads.
The fake WalletConnect-Airdrop Wallet application has been removed from Google Play now.
Still, this news serves as a warning for crypto investors.
Investors are advised to always crosscheck the legitimacy of any crypto-related app and to not download it from unknown sources.