Hackers can use your face to build deepfakes that deplete bank accounts.

A new mobile malware harvests personal information, including facial biometric data, for deepfakes, allowing hackers to deceive security systems, break into bank accounts, and steal funds, with one victim losing $40,000.

Biometric data theft

GoldPickaxe is a malware disguised as an app that steals user data, requests information during onboarding, and prompts users to take photos of their identity cards. The group, known for creating banking trojans like GoldDigger, GoldDiggerPlus, and GoldKefu, is believed to be responsible for the malware.

Asia-Pacific risk

GoldFactory targets people in the Asia-Pacific region, targeting Vietnam and Thailand. In March 2023, Thailand's central bank ordered banks to comply with biometric authentication for mobile banking. GoldPickaxe emerged three months after these measures were implemented, seemingly to circumvent them. With facial recognition being a common access and security feature in banks, GoldPickaxe-like malware could become a global threat, potentially being adopted by other threat groups or incorporated into existing malware strains.

Why this malware is effective

Deepfake malware is effective due to its sophistication and ease of bypassing non-3D facial recognition systems. Additionally, most security professionals, product developers, and the public are unaware of the fact that deepfakes can fool biometric systems.

Source: CyberTalk.org