November 8, 2016 By Douglas Bonderud 2 min read

Shopping is moving to mobile. With the holiday season rapidly approaching, more users than ever are turning to Android and iOS apps to get purchases made early and gifts delivered on time. The problem, as noted by Retail Dive, is that two-thirds of retailers still don’t have official mobile applications, leaving the door wide open for malicious actors.

According to The New York Times, Apple’s mobile software store was hit by “hundreds” of fake retail apps in the last few days. Beyond the obvious consumer risk, however, there’s a latent corporate concern — what happens when false advertising leads to compromised user access?

A Flood of Fake Retail Apps

The supposedly legitimate apps cover everything from sports retailers like Footlocker and Puma to department stores such as Nordstrom and Dillard’s. They even affect luxury brands like Jimmy Choo and Christian Dior.

Given that many brands are ramping up their marketing and sales campaigns before the all-important Black Friday and Cyber Monday, it’s not a stretch to imagine that they’re also rolling out new mobile apps. While this type of problem has plagued Android for years — Google is generally less restrictive about app submission policies — malicious developers are now finding ways to circumvent Apple’s acceptance process as well.

According to Fortune, the rapid uptake of mobile apps is making it more difficult for Apple to ensure each new offering is authored by a legitimate source and doesn’t contain malware. China-based developer Cloaker Apps, for example, is willing to develop branded mobile apps but merely “hopes” clients are who they say they are.

The company also lists offices in the same location as Facebook headquarters and has a number of dubious claims on its website. Regardless of Cloaker’s intentions or prior knowledge, however, it’s clear that fake apps are a booming business.

Personal and Corporate Data at Risk

The most obvious avenue of attack for these malicious mobile offerings is credit card information. Cybercriminals convince users they’re actually buying legitimate products and get them to input credit card data, which is then sold to the highest bidder.

As noted by New York Magazine, “relatively harmless” app iterations may simply display unending pop-up ads, while others might convince users to supply Facebook login data as a shortcut to access. This is now a common practice, even among legitimate apps.

For corporate users, however, there’s another level of potential risk here: If fake retail apps infect a dual-purpose mobile device with malware, attackers could gain access to company data such as usernames and passwords, confidential emails and product briefs. It may also lead to file-locking ransomware that can keep mobile business users from logging into their devices while on the road or spur the deletion of critical files.

What’s more, many users will hesitate to inform IT that poor personal app selection resulted in potential business compromise. This, of course, bumps up total corporate risk.

The holidays are coming, and with them a sleigh full of fake retail apps. While typical consumers may encounter issues with credit data or personal information, corporate-enabled devices duped by supposed seasonal apps could give cybercriminals the gift they’ve always wanted: unfettered network access.

More from

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

How I got started: AI security researcher

4 min read - For the enterprise, there’s no escape from deploying AI in some form. Careers focused on AI are proliferating, but one you may not be familiar with is AI security researcher. These AI specialists are cybersecurity professionals who focus on the unique vulnerabilities and threats that arise from the use of AI and machine learning (ML) systems. Their responsibilities vary, but key roles include identifying and analyzing potential security flaws in AI models and developing and testing methods malicious actors could…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today