Shopping is moving to mobile. With the holiday season rapidly approaching, more users than ever are turning to Android and iOS apps to get purchases made early and gifts delivered on time. The problem, as noted by Retail Dive, is that two-thirds of retailers still don’t have official mobile applications, leaving the door wide open for malicious actors.

According to The New York Times, Apple’s mobile software store was hit by “hundreds” of fake retail apps in the last few days. Beyond the obvious consumer risk, however, there’s a latent corporate concern — what happens when false advertising leads to compromised user access?

A Flood of Fake Retail Apps

The supposedly legitimate apps cover everything from sports retailers like Footlocker and Puma to department stores such as Nordstrom and Dillard’s. They even affect luxury brands like Jimmy Choo and Christian Dior.

Given that many brands are ramping up their marketing and sales campaigns before the all-important Black Friday and Cyber Monday, it’s not a stretch to imagine that they’re also rolling out new mobile apps. While this type of problem has plagued Android for years — Google is generally less restrictive about app submission policies — malicious developers are now finding ways to circumvent Apple’s acceptance process as well.

According to Fortune, the rapid uptake of mobile apps is making it more difficult for Apple to ensure each new offering is authored by a legitimate source and doesn’t contain malware. China-based developer Cloaker Apps, for example, is willing to develop branded mobile apps but merely “hopes” clients are who they say they are.

The company also lists offices in the same location as Facebook headquarters and has a number of dubious claims on its website. Regardless of Cloaker’s intentions or prior knowledge, however, it’s clear that fake apps are a booming business.

Personal and Corporate Data at Risk

The most obvious avenue of attack for these malicious mobile offerings is credit card information. Cybercriminals convince users they’re actually buying legitimate products and get them to input credit card data, which is then sold to the highest bidder.

As noted by New York Magazine, “relatively harmless” app iterations may simply display unending pop-up ads, while others might convince users to supply Facebook login data as a shortcut to access. This is now a common practice, even among legitimate apps.

For corporate users, however, there’s another level of potential risk here: If fake retail apps infect a dual-purpose mobile device with malware, attackers could gain access to company data such as usernames and passwords, confidential emails and product briefs. It may also lead to file-locking ransomware that can keep mobile business users from logging into their devices while on the road or spur the deletion of critical files.

What’s more, many users will hesitate to inform IT that poor personal app selection resulted in potential business compromise. This, of course, bumps up total corporate risk.

The holidays are coming, and with them a sleigh full of fake retail apps. While typical consumers may encounter issues with credit data or personal information, corporate-enabled devices duped by supposed seasonal apps could give cybercriminals the gift they’ve always wanted: unfettered network access.

More from

Security Awareness Training 101: Which Employees Need It?

4 min read - To understand why you need cybersecurity awareness training, you must first understand employees' outsized roles in security breaches. “People remain — by far — the weakest link in an organization’s cybersecurity defenses,” noted Verizon on the release of their 2022 Data Breach Investigations Report (DBIR). They elaborate that 25% of all breaches covered in the report were the result of social engineering attacks, and when you add human errors and misuse of privilege, the human element accounts for 82% of…

4 min read

Beyond Requirements: Tapping the Business Potential of Data Governance and Security

3 min read - Doom and gloom. Fear, uncertainty and doubt. The "stick" versus the "carrot". What do these concepts have in common? They have often provided the primary motivation for organizations’ data governance and security strategies. For the enterprise, this mindset has perpetuated the idea that data governance, data security and data privacy are reactive cost centers existing due to externally imposed requirements or mandates. Yet, what if data governance and security practices could upend the prevailing paradigm and demonstrate direct business value?…

3 min read

Protecting Against Remote Monitoring and Management Phishing

3 min read - You use remote monitoring and management (RMM) software to closely monitor your cyber environment and keep your organization safe. But now cyber criminals are specifically targeting these tools, causing legitimate software to become a vulnerability. This is the latest type of attack in an increase in a recent trend of disruptive software supply chain attacks. The Cybersecurity and Infrastructure Security Agency (CISA) recently released an alert about the malicious use of legitimate remote monitoring and management (RMM) software. Last fall,…

3 min read

Secure-by-Design: Which Comes First, Code or Security?

4 min read - For years, developers and IT security teams have been at loggerheads. While developers feel security slows progress, security teams assert that developers sacrifice security priorities in their quest to accelerate production. This disconnect results in flawed software that is vulnerable to attack. While advocates for speed and security clash, consumers must often pay the price when threat actors strike. 48% of developers admitted they were still shipping code with vulnerabilities in 2022. It’s clearly time for a change. Many believe…

4 min read