Crypto scam: Nearly 100,000 people fleeced by fake cryptomining apps

Business man trader investor analyst using mobile phone app analytics for cryptocurrency financial stock market analysis analyze graph trading data index investment growth chart on smartphone screen.

(Image credit: Insta_Photos | Shutterstock)

If some of your cryptocurrency-crazy friends seem a little more sheepish than usual today, it may be considering they were scammed by bogus Android apps that promised cloud-based mining services — just delivered nada.

Mobile security firm Picket revealed this morning (July 7) that it had establish more than than 170 unlike Android apps, 25 of which were in Google Play, that "advertise themselves as providing cloud cryptocurrency mining services for a fee."

Meridian cryptocurrency 2021 by value: Bitcoin, Ether, Dogecoin and more
The all-time Android antivirus apps
Plus: Microsoft releases emergency prepare for PrintNightmare flaw — what to do

Simply, Lookout researcher Ioannis Gasparis said in the company's study, "nosotros plant that no cloud crypto mining really takes place."

"Based on our analysis, they scammed more than than 93,000 people and stole at least $350,000 between users paying for apps and buying additional fake upgrades and services," said Gasparis.

These scams largely went undetected because they're non malicious. They don't steal information or install malware. Google's malware detectors won't choice them up, and neither will the best Android antivirus apps.

"In fact, they hardly do annihilation at all," Gasparis wrote. "They are but shells to collect money for services that don't exist."

A side of virtual hardware with that?

The apps seem to autumn into two dissimilar groups based on their code, Lookout said, indicating that multiple groups of scammers are cashing in on the cryptocurrency craze.

The "BitScam" group of apps will take payment for subscriptions, services and in-app upgrades in Bitcoin and Ethereum tokens (technically violating Google Play's terms of service), while the "CloudScam" grouping took regular credit-card payments. Upgrades costs as much every bit $250 for a "virtual hardware" bundle.

However, both sets of apps blocked users from actually withdrawing any of their "mined" coins. If you tried to withdraw some cryptocash, you'd be told that your balance wasn't sufficiently high plenty to allow that.

All 25 of these scam apps that were in Google Play accept been removed, Lookout said, simply those and most 150 others can all the same be plant in "off-route" app stores. Lookout has a full listing of the scam apps here.

What you tin, and can't, practice about this

Needless to say, if y'all have whatever of these apps on your Android telephone, go into Settings > Apps & Notifications and select and uninstall them. If yous've paid for these apps and/or their services and subscriptions using a credit carte, you can attempt to claw back the fees from your menu issuer.

But if you paid using Bitcoin or Ethereum tokens, then you're probably not going to become whatever of that money dorsum.

Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has also been a dishwasher, fry melt, long-haul driver, lawmaking monkey and video editor. He's been rooting effectually in the information-security infinite for more fifteen years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random TV news spots and even moderated a panel discussion at the CEDIA home-engineering science conference. You can follow his rants on Twitter at @snd_wagenseil.