November 8, 2016 By Douglas Bonderud 2 min read

Shopping is moving to mobile. With the holiday season rapidly approaching, more users than ever are turning to Android and iOS apps to get purchases made early and gifts delivered on time. The problem, as noted by Retail Dive, is that two-thirds of retailers still don’t have official mobile applications, leaving the door wide open for malicious actors.

According to The New York Times, Apple’s mobile software store was hit by “hundreds” of fake retail apps in the last few days. Beyond the obvious consumer risk, however, there’s a latent corporate concern — what happens when false advertising leads to compromised user access?

A Flood of Fake Retail Apps

The supposedly legitimate apps cover everything from sports retailers like Footlocker and Puma to department stores such as Nordstrom and Dillard’s. They even affect luxury brands like Jimmy Choo and Christian Dior.

Given that many brands are ramping up their marketing and sales campaigns before the all-important Black Friday and Cyber Monday, it’s not a stretch to imagine that they’re also rolling out new mobile apps. While this type of problem has plagued Android for years — Google is generally less restrictive about app submission policies — malicious developers are now finding ways to circumvent Apple’s acceptance process as well.

According to Fortune, the rapid uptake of mobile apps is making it more difficult for Apple to ensure each new offering is authored by a legitimate source and doesn’t contain malware. China-based developer Cloaker Apps, for example, is willing to develop branded mobile apps but merely “hopes” clients are who they say they are.

The company also lists offices in the same location as Facebook headquarters and has a number of dubious claims on its website. Regardless of Cloaker’s intentions or prior knowledge, however, it’s clear that fake apps are a booming business.

Personal and Corporate Data at Risk

The most obvious avenue of attack for these malicious mobile offerings is credit card information. Cybercriminals convince users they’re actually buying legitimate products and get them to input credit card data, which is then sold to the highest bidder.

As noted by New York Magazine, “relatively harmless” app iterations may simply display unending pop-up ads, while others might convince users to supply Facebook login data as a shortcut to access. This is now a common practice, even among legitimate apps.

For corporate users, however, there’s another level of potential risk here: If fake retail apps infect a dual-purpose mobile device with malware, attackers could gain access to company data such as usernames and passwords, confidential emails and product briefs. It may also lead to file-locking ransomware that can keep mobile business users from logging into their devices while on the road or spur the deletion of critical files.

What’s more, many users will hesitate to inform IT that poor personal app selection resulted in potential business compromise. This, of course, bumps up total corporate risk.

The holidays are coming, and with them a sleigh full of fake retail apps. While typical consumers may encounter issues with credit data or personal information, corporate-enabled devices duped by supposed seasonal apps could give cybercriminals the gift they’ve always wanted: unfettered network access.

More from

Cyberattack on American Water: A warning to critical infrastructure

3 min read - American Water, the largest publicly traded United States water and wastewater utility, recently experienced a cybersecurity incident that forced the company to disconnect key systems, including its customer billing platform. As the company’s investigation continues, there are growing concerns about the vulnerabilities that persist in the water sector, which has increasingly become a target for cyberattacks. The breach is a stark reminder of the critical infrastructure risks that have long plagued the industry. While the water utility has confirmed that…

What’s behind unchecked CVE proliferation, and what to do about it

4 min read - The volume of Common Vulnerabilities and Exposures (CVEs) has reached staggering levels, placing immense pressure on organizations' cyber defenses. According to SecurityScorecard, there were 29,000 vulnerabilities recorded in 2023, and by mid-2024, nearly 27,500 had already been identified.Meanwhile, Coalition's 2024 Cyber Threat Index forecasts that the total number of CVEs for 2024 will hit 34,888—a 25% increase compared to the previous year. This upward trend presents a significant challenge for organizations trying to manage vulnerabilities and mitigate potential exploits.What’s behind…

Quishing: A growing threat hiding in plain sight

4 min read - Our mobile devices go everywhere we go, and we can use them for almost anything. For businesses, the accessibility of mobile devices has also made it easier to create more interactive ways to introduce new products and services while improving user experiences across different industries. Quick-response (QR) codes are a good example of this in action and help mobile devices quickly navigate to web pages or install new software by simply scanning an image.However, legitimate organizations aren’t the only ones…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today