假冒加密货币钱包应用程序在被从 Google Play 商店删除之前从用户那里窃取了超过 70,000 美元

该欺诈性应用程序由网络安全公司 Check Point Research (CPR) 发现，模仿合法的 WalletConnect 协议并针对移动用户。

A fake crypto wallet app, posing as WalletConnect, managed to slip past Google’s defenses and was available on the Play Store for five months. The fraudulent app stole over $70,000 in crypto from users before being taken down.

一款冒充 WalletConnect 的假冒加密钱包应用成功突破了 Google 的防御，并在 Play 商店上架了五个月。该欺诈性应用程序在被下架之前从用户那里窃取了超过 70,000 美元的加密货币。

The scam app was discovered by cybersecurity firm Check Point Research (CPR), which found that it mimicked the legitimate WalletConnect protocol and targeted mobile users. Over 10,000 users downloaded the app, and around 150 reported losing their cryptocurrency.

该诈骗应用程序是由网络安全公司 Check Point Research (CPR) 发现的，该公司发现它模仿合法的 WalletConnect 协议并针对移动用户。超过 10,000 名用户下载了该应用程序，大约 150 名用户报告丢失了他们的加密货币。

The scammers took advantage of common challenges faced by Web3 users, such as compatibility problems between cryptocurrency wallets. They promoted the app as a solution to these issues, especially exploiting the absence of an official WalletConnect app on the Play Store. This deception and numerous fake positive reviews made the app appear authentic to unsuspecting users.

诈骗者利用了 Web3 用户面临的常见挑战，例如加密货币钱包之间的兼容性问题。他们推广该应用程序作为这些问题的解决方案，特别是利用 Play 商店中缺少官方 WalletConnect 应用程序的机会。这种欺骗和大量虚假的正面评论使该应用程序对于毫无戒心的用户来说显得真实。

Once installed, the app prompted users to link their cryptocurrency wallets under the pretense of offering seamless access to Web3 applications. When users authorized transactions, they were redirected to a malicious website that stole their wallet details, including blockchain addresses. Using these details, the scammers initiated unauthorized transfers, draining funds from the victims’ wallets.

安装后，该应用程序会提示用户以提供对 Web3 应用程序的无缝访问的借口链接他们的加密货币钱包。当用户授权交易时，他们会被重定向到一个恶意网站，该网站窃取了他们的钱包详细信息，包括区块链地址。诈骗者利用这些详细信息发起未经授权的转账，从受害者的钱包中抽走资金。

Despite its fraudulent nature, the crypto wallet app remained on the Google Play Store for five months. Its deceptive reviews allowed it to evade detection for an extended period. CPR’s investigation ultimately revealed the scam, estimating that around $70,000 was stolen from the victims’ wallets.

尽管具有欺诈性质，该加密钱包应用程序仍在 Google Play 商店中保留了五个月。它的欺骗性评论使其能够在很长一段时间内逃避检测。 CPR 的调查最终揭露了这一骗局，估计受害者钱包中约有 70,000 美元被盗。

Following the CPR report, Google took down the malicious app and highlighted its Google Play Protect feature, designed to protect Android users from known threats. However, this incident follows similar attacks targeting mobile users, including a previous case where over 11 million Android users unknowingly downloaded apps infected with Necro malware.

在 CPR 报告发布后，谷歌下架了该恶意应用程序，并强调了其 Google Play Protect 功能，该功能旨在保护 Android 用户免受已知威胁。然而，在此事件之前，针对移动用户的类似攻击也发生过，其中包括之前超过 1100 万 Android 用户在不知情的情况下下载了感染 Necro 恶意软件的应用程序的案例。

Michael McLaughlin, a cybersecurity expert, emphasized the need for users to be cautious when downloading cryptocurrency apps. He advised users to implement multi-factor authentication for added security on cryptocurrency trading platforms. McLaughlin also recommended thoroughly checking app reviews and history for sudden changes before downloading, as scammers often rebrand existing apps to deceive users.

网络安全专家迈克尔·麦克劳林强调，用户在下载加密货币应用程序时需要谨慎。他建议用户实施多重身份验证，以提高加密货币交易平台的安全性。麦克劳林还建议在下载之前彻底检查应用程序评论和历史记录是否发生突然变化，因为诈骗者经常重新命名现有应用程序来欺骗用户。

“If you’re using a crypto trading platform—and it could be Coinbase, it could be Kraken, it could be any of those— they offer multi-factor authentication even on their mobile applications. And you have to implement them,” said McLaughlin

“如果你使用加密货币交易平台——可能是 Coinbase，可能是 Kraken，也可能是其中任何一个——他们甚至在移动应用程序上也提供多因素身份验证。你必须实施它们，”麦克劳克林说