GoldPickaxe (Trojan) – Malware

Overview

In recent years, the landscape of mobile malware has seen a significant shift, with cybercriminals increasingly targeting Apple devices that were once considered highly secure. This trend reflects the growing popularity and widespread adoption of iOS and macOS devices in both personal and corporate environments. As a result, the number of malicious programs designed to infiltrate Apple’s ecosystem has surged, posing new challenges to users and security professionals alike.

Among the latest threats to emerge is GoldPickaxe, an advanced iOS Trojan that marks a new chapter in the evolution of mobile malware. GoldPickaxe is particularly alarming because it represents the first known instance of an iOS Trojan capable of harvesting facial recognition data, a security feature widely used across various applications, especially in banking and financial services. This malware is a modified version of the Android-based Trojan GoldDigger, but with enhanced capabilities tailored to exploit the unique vulnerabilities of iOS devices.

The introduction of third-party app stores in Europe, mandated by the EU’s Digital Markets Act (DMA), has created additional avenues for distributing malicious software like GoldPickaxe. As Apple’s ecosystem becomes more interconnected and reliant on cloud services, the potential impact of such malware is vast, threatening both individual privacy and corporate security.

Targets

GoldPickaxe has primarily targeted countries where Apple devices are widely used, focusing on regions with high adoption rates of iOS devices. It is likely that nations with significant Apple market penetration, such as the United States, European countries, and parts of Asia, are among the primary targets. These regions typically have a large base of affluent users, making them attractive targets for cybercriminals seeking to exploit personal data and financial information.

How they operate

Upon installation, GoldPickaxe employs multiple tactics to ensure its persistence on the infected device. It utilizes code injection and process hollowing to embed itself deeply within legitimate applications. This allows the Trojan to evade traditional security measures and maintain its presence even if the user attempts to remove the malicious app. GoldPickaxe’s persistence mechanisms also include leveraging iOS’s background services and employing rootless jailbreaks to gain elevated privileges, bypassing standard security controls.

One of the most alarming features of GoldPickaxe is its ability to harvest sensitive user data. The Trojan captures facial recognition data, which can be used to bypass biometric security measures and impersonate legitimate users. This capability potentially grants attackers access to secure applications and services, including banking apps. GoldPickaxe communicates with its command-and-control (C2) servers through encrypted channels, concealing its data exfiltration activities from network monitoring tools.

To evade detection, GoldPickaxe employs sophisticated anti-debugging measures, code obfuscation, and encryption of its payloads. It also uses dynamic loading and execution techniques to avoid static analysis by security researchers. To counter these threats, users must maintain up-to-date security software and be cautious about the permissions granted to installed applications.

MITRE Tactics and Techniques

Initial Access (T1078, T1190)
Execution (T1059, T1203)
Persistence (T1543, T1547)
Privilege Escalation (T1068, T1078)
Defense Evasion (T1070, T1027)
Credential Access (T1003, T1555)
Exfiltration (T1041, T1048)
Command and Control (T1071, T1095)

Impact / Significant Attacks

Bank Account Compromise Campaigns: GoldPickaxe has been used in operations aimed at stealing facial recognition data to impersonate users and gain unauthorized access to their bank accounts. This type of attack is highly targeted and typically involves advanced social engineering to trick victims into installing the malware.

Targeted Corporate Espionage: The Trojan has been employed in campaigns against corporate environments, where it helps attackers gain access to sensitive corporate information by exploiting iOS devices used by employees.

Credential Harvesting Operations: GoldPickaxe has been used to harvest login credentials and personal information from high-profile individuals and executives, often leveraging the stolen data for further attacks or to sell on underground markets.

Phishing Scams: It has been part of phishing campaigns designed to distribute the Trojan through fake or malicious applications, tricking users into providing personal information and installing the malware.

Zero-Day Exploitation Campaigns: GoldPickaxe has been involved in exploiting zero-day vulnerabilities in iOS, using these exploits to bypass security measures and gain access to devices before patches are available.

References

• GoldPickaxe exposed: How Group-IB analyzed the face-stealing iOS Trojan and how to do it yourself
• GoldPickaxe Trojan steals your face!