Another malicious application disguised as MetaMask

A new malicious clipper application disguised as Ethereum wallet MetaMask was discovered in the Google Play app store. This was reported by the company Eset.

As security specialist Lukas Stefanko writes in the company's blog, the purpose of the application was to steal data needed to gain access to users' Ethereum wallets. In particular, it could replace the addresses of the purses copied to the clipboard with the addresses of hackers.

"This attack is aimed at users of the mobile version of the MetaMask service, designed to launch decentralized Ethereum-based applications […] Currently, this service, however, does not have a mobile application – only extensions for desktop browsers such as Chrome and Firefox", – wrote Stefanko.

The application was discovered shortly after its appearance on Google Play on February 1 and has now been removed from the store. As Stefanko noted, such a clipper hit Google Play for the first time – previously there were already malicious applications posing as MetaMask, but they were only able to steal critical information to gain access to the victim’s cryptocurrency funds.

Google claims to regularly scan more than 50 billion applications for viruses, backdoors, spyware, phishing tools, spam, and various tricks that allow fraudsters to access devices and personal user data. Despite this, cybersecurity experts regularly find malware that is disguised as games, television applications and programs for remote control.

Recall that in November last year, Eset discovered four fake cryptocurrency wallet on Google Play, stealing personal data. In particular, they imitated wallets for Neo (NEO), Tether (USDT) and Ethereum (ETH). The latter also impersonated MetaMask.

Subscribe to the BlockchainJournal news in Telegram: BlockchainJournal Live – the entire news feed, BlockchainJournal – the most important news and polls.