Is Your iPhone Safe? The New GoldDigger Trojan Can Steal Your Face ID Data

Apple's reputation for security is being challenged by a new threat, the GoldDigger trojan, according to a recent report by Group-IB. This marks the first instance of a trojan designed specifically for iOS devices, targeting the Face ID data of users to facilitate banking fraud. The discovery of the GoldDigger trojan raises concerns over the safety of iOS users' sensitive information and underlines the evolving nature of cyber threats.

Understanding the GoldDigger Trojan

Originally developed for Android devices, the GoldDigger trojan, named after the term GoldActivity found in its APK, has made its way to iOS. Group-IB's latest findings reveal an advanced version of this malware, dubbed GoldPickaxe, which targets iOS users. Furthermore, an even more sophisticated variant, GoldDiggerPlus, enables real-time calls to victims on infected devices. The primary aim of the GoldPickaxe malware is to harvest users' facial recognition data, identity documents, and intercept SMS for creating deepfakes and committing banking fraud.

The malware, developed by GoldFactory, was first identified in October in Vietnam and has since impacted users in both Vietnam and Thailand. The Group-IB report warns that the successful deployment of this malware could lead to its spread to other regions globally.

How GoldDigger Trojan Infects iOS Devices

Cybercriminals have exploited Apple's TestFlight program to distribute the malicious app, though Apple quickly responded by removing it. However, the attackers have shifted tactics, now using Mobile Device Management (MDM) to spread the trojan. They deceive users into installing a harmful MDM profile, granting them access to the device.

Securing Your iPhone Against GoldDigger Trojan

While Apple is actively working on a solution to combat the trojan, users can take several measures to protect their devices. Foremost, iOS users are advised to avoid downloading any apps from TestFlight or installing TestFlight entirely. Additionally, extreme caution is recommended when installing any MDM profile on their iPhones. For those using corporate iPhones, enabling Lockdown Mode is suggested to safeguard data from any malicious MDM profiles potentially pushed by their company's IT department. Activating Lockdown Mode involves navigating to the Privacy & Security settings, selecting Lockdown Mode, and following the prompts to turn it on and restart the device.