Full Report
Group-IB uncovers the first iOS Trojan harvesting facial recognition data used for unauthorized access to bank accounts. The GoldDigger family grows
Analysis Summary
# Tool/Technique: GoldPickaxe (GoldDigger Family)
## Overview
GoldPickaxe is a sophisticated mobile banking Trojan family, representing a significant evolution of the "GoldDigger" Android malware. It is notably the first discovered iOS Trojan specifically designed to harvest facial recognition data, identity documents, and intercept SMS to facilitate unauthorized access to bank accounts. By combining biometric theft with AI-driven face-swapping techniques, attackers can bypass security measures and perform fraudulent transactions.
## Technical Details
- **Type:** Malware family (Banking Trojan)
- **Platform:** iOS, Android
- **Capabilities:** Biometric data theft (facial recognition), identity document harvesting, SMS interception, traffic tunneling, and automated UI interaction.
- **First Seen:** October 2023 (GoldDigger); early 2024 (GoldPickaxe.iOS variant).
## MITRE ATT&CK Mapping
- **[TA0027 - Initial Access]**
- **[T1474 - Supply Chain Compromise]** (Abuse of TestFlight/MDM)
- **[T1566 - Phishing]**
- **[TA0030 - Credential Access]**
- **[T1417.001 - Input Capture: Keylogging]**
- **[T1641 - Acquire User Biometric Information]**
- **[TA0035 - Collection]**
- **[T1512 - Screen Capture]**
- **[T1636.002 - File and Repository Discovery: Local File System]**
- **[TA0041 - Impact]**
- **[T1471 - Financial Theft]**
## Functionality
### Core Capabilities
- **Facial Recognition Harvesting:** Prompts users to record a video of their face, which is then exfiltrated to be used for AI face-swapping.
- **ID Theft:** Requests users to photograph government-issued ID cards to verify identity.
- **SMS Interception:** Captures one-time passwords (OTPs) and transaction confirmation codes.
- **C2 Communication:** Communicates with Command and Control servers to receive tasks and upload stolen media/data.
### Advanced Features
- **MDM Abuse:** The iOS variant utilizes Mobile Device Management (MDM) profiles to bypass App Store security and install the malicious payload directly on non-jailbroken devices.
- **Face-Swapping Integration:** The stolen biometric data is utilized by threat actors to create deepfakes, allowing them to bypass liveness checks in banking apps.
- **Cross-Platform Parity:** Developed for both Android and iOS, sharing high levels of code logic and targeting similar financial institutions (primarily in Southeast Asia).
## Indicators of Compromise
- **File Hashes:**
- **GoldPickaxe.iOS:** `4571f8c8560a8a66a90763d7236f55273750cf8dd8f4fdf443b5a07d7a93a3df`
- **GoldPickaxe.Android:** `b72d9a6bd2c350f47c06dfa443ff7baa59eed090ead34bd553c0298ad6631875`
- **GoldDigger:** `d8834a21bc70fbe202cb7c865d97301540d4c27741380e877551e35be1b7276b`
- **GoldDiggerPlus:** `b5dd9b71d2a359450d590bcd924ff3e52eb51916635f7731331ab7218b69f3b9`
- **Network Indicators:**
- `ms2ve[.]cc`
- `hds6y[.]cc`
- `smgeo[.]cc`
- `www[.]dg1e[.]com`
- `ks8cb[.]cc`
- `wbke[.]cc`
- `rtmp://18.142.163[.]73:1935/live/`
- `t8bc[.]xyz`
- `bv8k[.]xyz`
- **Behavioral Indicators:**
- Requests for unusual permissions (Accessibility Services on Android, MDM Profile installation on iOS).
- Unexplained battery drain and overheating.
- Sudden appearance of "Digital Government" or "Bank Support" themed apps installed via browser links rather than official stores.
## Associated Threat Actors
- **GoldFactory:** A sophisticated Chinese-speaking threat group focused on high-value financial fraud.
## Detection Methods
- **Signature-based detection:** Identify known hashes of GoldPickaxe samples and associated certificates used for MDM signing.
- **Behavioral detection:** Monitor for unauthorized SMS reading, excessive background camera usage, and the installation of unrecognized MDM profiles.
- **Network Monitoring:** Block traffic to the known C2 domains and IP addresses listed in the IOC section.
## Mitigation Strategies
- **Do not install MDM profiles** from unknown or untrusted websites.
- **Avoid TestFlight invitations** for apps from unknown developers.
- **Restrict App Installations:** Only download applications from the official Apple App Store or Google Play Store.
- **Biometric Safeguards:** Enable multi-factor authentication (MFA) that does not rely solely on SMS or facial recognition (e.g., hardware tokens or authenticator apps).
- **Update OS:** Keep iOS and Android versions up to date to ensure the latest security patches are active.
## Related Tools/Techniques
- **GoldDigger:** The predecessor Android banking Trojan.
- **GoldKefu:** A variant embedded with fake customer service interaction capabilities.
- **Deepfake/Face-swapping:** The primary social engineering/bypass technique used in conjunction with the stolen data.