Full Report
Learn how to protect your devices against evolving iOS threats
Analysis Summary
# Tool/Technique: GoldPickaxe.iOS
## Overview
GoldPickaxe.iOS is a sophisticated mobile banking trojan specifically designed to target iOS users. It is part of the "GoldFactory" malware family and is primarily used to harvest facial recognition data (biometrics), identity documents, and intercept SMS messages to facilitate unauthorized access to banking accounts. It represents a significant evolution in iOS threats, as it bypasses traditional "walled garden" security by leveraging legitimate distribution frameworks.
## Technical Details
- **Type:** Malware Family (Banking Trojan)
- **Platform:** iOS
- **Capabilities:** Biometric data theft (FaceID), identity document harvesting, SMS interception, traffic tunneling through SOCKS5.
- **First Seen:** October 2023 (Identified by Group-IB)
## MITRE ATT&CK Mapping
- **[TA0029 - Initial Access]**
- T1474 - Supply Chain Compromise (Abuse of TestFlight/MDM)
- **[TA0035 - Collection]**
- T1429 - Screen Capture
- T1512 - Data from Device Resources (Camera/Biometrics)
- **[TA0037 - Command and Control]**
- T1571 - Non-Standard Port
- T1572 - Protocol Tunneling (SOCKS5)
- **[TA0041 - Credential Access]**
- T1411 - Input Capture (SMS Interception)
## Functionality
### Core Capabilities
- **Biometric Theft:** Prompts users to record a video of their face, which is then used by threat actors to generate AI deepfakes for bypassing banking biometric verification.
- **Identity Harvesting:** Requests photos of ID cards and official documents.
- **SMS Interception:** Captures incoming text messages, typically to steal One-Time Passwords (OTPs) and 2FA codes.
- **C2 Communication:** Communicates with a command-and-control server to exfiltrate data and receive instructions.
### Advanced Features
- **Abuse of TestFlight:** Initially distributed via Apple’s TestFlight platform to bypass the App Store's rigorous review process.
- **MDM Profile Exploitation:** After removal from TestFlight, the actors transitioned to using Malicious Mobile Device Management (MDM) profiles to gain control over devices and install the malware.
- **Traffic Proxying:** Utilizes SOCKS5 to tunnel network traffic, potentially to mask the origin of fraudulent banking transactions.
## Indicators of Compromise
- **File Names:** GoldPickaxe (often disguised as government or financial service apps).
- **Network Indicators:**
- [hxxp]://45.150.130[.]119:8333
- [hxxp]://103.153.217[.]228:8333
- **Behavioral Indicators:**
- Installation of unexpected MDM profiles.
- Requests for video recordings of the user's face within non-banking apps.
- Prompting for sensitive ID documents (ID cards, passports) under the guise of "verification."
## Associated Threat Actors
- **GoldFactory:** A prolific Chinese-speaking cybercrime group responsible for the development of both GoldDigger and GoldPickaxe variants.
## Detection Methods
- **Behavioral Detection:** Monitoring for anomalous sessions where a user's device begins communicating with known malicious C2 IPs or uses SOCKS5 proxies unexpectedly.
- **MDM Auditing:** Identifying the presence of unauthorized or suspicious Mobile Device Management profiles on the device.
- **System Monitoring:** Utilizing tools like Group-IB Fraud Protection to detect session anomalies before data entry occurs.
## Mitigation Strategies
- **MDM Hygiene:** Refrain from installing unknown MDM profiles or certificates, as these grant deep access to the OS.
- **Distribution Caution:** Avoid engaging in unknown TestFlight campaigns or downloading apps from links in SMS/social media.
- **Hardware Upgrades:** Transition to devices with the A12 Bionic chip or later, as older devices are more vulnerable to low-level exploits like Checkm8.
- **Permission Management:** Be extremely alert when an application requests "Accessibility Services" or camera permissions without a clear, legitimate need.
- **Credential Security:** Use unique Apple IDs for older devices and always maintain an active passcode to ensure data encryption.
## Related Tools/Techniques
- **GoldDigger:** The Android-based predecessor to GoldPickaxe.
- **GoldDiggerPlus:** An enhanced variant capable of making unauthorized calls and intercepting communications.
- **Checkm8:** A bootrom exploit used by attackers to gain persistence or deeper access on older iOS hardware.