Biometric Heist: Attackers Steal Personal Data to Access Bank Accounts of Victims

The Growing Threat of Biometric Authentication

Biometrics—such as facial recognition, fingerprints, and iris scans—are often promoted as the ultimate form of identity verification. Their uniqueness to each individual makes them seem foolproof. However, cybersecurity threats are evolving, revealing that biometric systems can be compromised just like traditional authentication methods.

Recent findings from Group-IB, a cybersecurity company, highlight a new banking Trojan that targets facial recognition systems. In a sophisticated scheme, attackers deceived users into providing personal information and conducting face scans. These real images were then replaced with AI-generated deepfakes, allowing criminals to bypass security measures.

The Trojan's Operation

Developed by a Chinese hacking group, this method was notably deployed in Vietnam, where attackers lured a victim into a malicious app. After obtaining a face scan, they withdrew approximately $40,000 from the victim's bank account. Sharmine Low, a malware analyst at Group-IB, emphasized the emergence of malware specifically designed to harvest facial recognition data and facilitate interactions between victims and cybercriminals masquerading as bank representatives.

Alarming Trends in Biometric Threats

Recent statistics from iProov's Threat Intelligence Report indicate a staggering 704% increase in face-swap deepfake attacks between the first and second halves of 2023. Additionally, there was a 672% rise in deepfake media usage alongside spoofing techniques and a 353% increase in device emulators for digital injection attacks. Generative AI has significantly enhanced the capabilities of these threat actors, allowing for the creation of highly convincing deepfakes at a low cost.

According to Gartner, by 2026, 30% of enterprises may no longer view biometric tools as reliable standalone solutions. Gartner VP Analyst Akif Khan warns that organizations may struggle to distinguish between authentic identities and deepfake impersonations.

The Unique Risks of Biometrics

Unlike passwords or passkeys, biometric data—our unique biological traits—cannot be changed, which raises significant security concerns. The potential for misuse is further evidenced by the discovery of GoldPickaxe.iOS, an unknown Trojan capable of intercepting text messages and extracting facial recognition data. This sensitive information can then be used to create deepfake profiles that impersonate the victims.

GoldPickaxe.iOS, developed by the GoldFactory group, employs aggressive phishing techniques, often posing as government service agents, particularly targeting the elderly across Asia Pacific. As regulatory requirements shift towards facial recognition for high-value transactions, the threat of these trojans looms larger.

A New Fraud Technique

In Thailand, GoldPickaxe.iOS was disguised as an app promising digital pension access, prompting victims to take pictures of themselves and their ID cards. The trojan even provided specific instructions for users as part of the face-swap process, creating comprehensive biometric profiles that criminals can use for unauthorized access.

Low notes that this method represents a new and concerning tactic in identity fraud, capitalizing on the lucrative landscape of mobile malware.

Safeguarding Against Biometric Attacks

To protect yourself from biometric scams, consider these essential tips:

- Avoid clicking on suspicious links in emails, texts, or social media.

- Download apps only from reputable sources like the Google Play Store or Apple App Store.

- Proceed cautiously with third-party app downloads.

- Carefully review permissions during app installations, particularly regarding accessibility services.

- Be wary of adding unknown contacts to messaging apps; if uncertain, contact your bank directly instead of responding to pop-up alerts.

Signs of Malware Infection

Be vigilant for signs that your device may be infected with malware, such as:

- Rapid battery depletion, slow performance, unusual data usage, or overheating.

- Unfamiliar apps that may be disguising malicious software.

- Sudden changes in app permissions.

- Strange behaviors, like unsolicited calls or messages.

Staying informed and cautious is your best defense against the evolving landscape of biometric attacks.