Shopping is moving to mobile. With the holiday season rapidly approaching, more users than ever are turning to Android and iOS apps to get purchases made early and gifts delivered on time. The problem, as noted by Retail Dive, is that two-thirds of retailers still don’t have official mobile applications, leaving the door wide open for malicious actors.
According to The New York Times, Apple’s mobile software store was hit by “hundreds” of fake retail apps in the last few days. Beyond the obvious consumer risk, however, there’s a latent corporate concern — what happens when false advertising leads to compromised user access?
A Flood of Fake Retail Apps
The supposedly legitimate apps cover everything from sports retailers like Footlocker and Puma to department stores such as Nordstrom and Dillard’s. They even affect luxury brands like Jimmy Choo and Christian Dior.
Given that many brands are ramping up their marketing and sales campaigns before the all-important Black Friday and Cyber Monday, it’s not a stretch to imagine that they’re also rolling out new mobile apps. While this type of problem has plagued Android for years — Google is generally less restrictive about app submission policies — malicious developers are now finding ways to circumvent Apple’s acceptance process as well.
According to Fortune, the rapid uptake of mobile apps is making it more difficult for Apple to ensure each new offering is authored by a legitimate source and doesn’t contain malware. China-based developer Cloaker Apps, for example, is willing to develop branded mobile apps but merely “hopes” clients are who they say they are.
The company also lists offices in the same location as Facebook headquarters and has a number of dubious claims on its website. Regardless of Cloaker’s intentions or prior knowledge, however, it’s clear that fake apps are a booming business.
Personal and Corporate Data at Risk
The most obvious avenue of attack for these malicious mobile offerings is credit card information. Cybercriminals convince users they’re actually buying legitimate products and get them to input credit card data, which is then sold to the highest bidder.
As noted by New York Magazine, “relatively harmless” app iterations may simply display unending pop-up ads, while others might convince users to supply Facebook login data as a shortcut to access. This is now a common practice, even among legitimate apps.
For corporate users, however, there’s another level of potential risk here: If fake retail apps infect a dual-purpose mobile device with malware, attackers could gain access to company data such as usernames and passwords, confidential emails and product briefs. It may also lead to file-locking ransomware that can keep mobile business users from logging into their devices while on the road or spur the deletion of critical files.
What’s more, many users will hesitate to inform IT that poor personal app selection resulted in potential business compromise. This, of course, bumps up total corporate risk.
The holidays are coming, and with them a sleigh full of fake retail apps. While typical consumers may encounter issues with credit data or personal information, corporate-enabled devices duped by supposed seasonal apps could give cybercriminals the gift they’ve always wanted: unfettered network access.