Zimperium Details GoldPickaxe Variant Stealing Banking and Biometric Data
Summary
Zimperium’s zLabs describes a GoldPickaxe variant attributed to GoldFactory, distributed through KuaiBo-spoofing phishing sites. It reports 19 samples across five countries and details Android techniques used to steal banking credentials, biometrics and other data.
Key points
- Zimperium attributes the campaign to GoldFactory and reports 19 samples across devices in Indonesia, Malaysia, the United States, Singapore and Saudi Arabia.
- KuaiBo-spoofing phishing sites lure users into installing a dropper APK, which uses Android’s SessionInstaller API to install a second-stage payload.
- The payload hides encrypted code in payload_dex.bin and loads it dynamically; it also omits a launcher icon and manipulates its manifest to hinder analysis.
- Fake lock-screen and app overlays, keylogging, and disabling facial recognition can be used to capture PINs, patterns, passwords and other user input.
- The malware can collect SMS, contacts, call logs, installed-app and device information, and prompt users to provide ID images or facial video.
- Accessibility Services enable screen scraping, while Media Projection enables live screen sharing; C2 commands can also download additional APKs.
- Zimperium describes AES-encrypted C2 traffic with dynamic IVs; its researchers say dynamic instrumentation let them extract keys and decrypt the traffic.
Article Details
- Attack Vectors
- Phishing websites impersonating KuaiBo lure users into downloading and manually installing a Dropper APK.
- The dropper uses Android SessionInstaller to install a secondary payload.
- Fake lock-screen, biometric-verification, ministry, and app-dialog overlays trick users into providing credentials, identity data, or permissions.
- The malware can redirect victims to a malicious website specified by its C2 server after they interact with a fake dialog.
- Defensive Notes
- Zimperium reports that its Mobile Threat Defense platform detected and stopped the infection attempt.
- The article recommends identifying potentially compromised mobile devices rather than relying only on signature-based detection.
- Zimperium Web Content Filtering is described as blocking known malicious pathways, including phishing and C2 communications.
- The article says zDefend can detect behavioral indicators such as unauthorized screen sharing, accessibility-based screen scraping, and overlay injection.
MITRE ATT&CK
T1406The malware decrypts payload_dex.bin and dynamically loads the code at runtime using key material from dex_IV.bin and dex_key.bin.T1417.002A fake lock screen captures PINs, patterns, or passwords, while keylogging monitors user input.T1418GoldPickaxe enumerates installed applications and collects their names, package names, and icons.T1453The malware uses Android Accessibility Services to scrape screen elements and send them to its C2 server in JSON.T1512A fake facial-verification flow prompts victims to record a face video, which the malware sends to its C2 server.T1513The malware abuses Media Projection to capture the live screen and share the victim's UI.T1521.001The native library libnaLib.so encrypts C2 traffic with AES and uses dynamically generated IVs based on request timestamps.T1544Remote C2 commands can provide a URL from which the malware downloads secondary APK payloads.T1623The dropper abuses Android SessionInstaller to install the secondary payload.T1624.001Background broadcast receivers and system-event triggers allow the malware to initialize or restart without direct user interaction.T1628.001The payload omits MAIN and LAUNCHER intent filters so its icon does not appear on the home screen.T1629Malformed manifest XML is intended to disrupt JADX and Apktool analysis; a separate command disables facial recognition to force PIN or pattern authentication.T1646GoldPickaxe sends collected credentials, biometric data, ID photos, and SMS data over its C2 channel.T1655Activity aliases and spoofed overlays, including a fake Indonesian ministry interface, disguise malicious activity and solicit user interaction.T1660Spoofed KuaiBo websites lure users to download the malicious Dropper APK.
Threat Actors
Malware
Vendors
Products
AndroidThe Trojan uses Android SessionInstaller abuse, dynamic code loading, encrypted communication, manifest tampering, and hidden app icons to evade detection and persistence controls.KuaiBoZimperium identified a new GoldPickaxe variant targeting mobile banking users through phishing sites spoofing KuaiBo, with infections observed across five countries and 19 samples in the wild.Mobile Runtime Protection (zDefend)Advanced Malware and Dropper Detection: Both Zimperium MTD (Mobile Threat Defense) and zDefend (Mobile Application Runtime Protection) are engineered to detect both the initial, low-profile dropper sample and the
Tools
apktool[T1629 ] Impair Defenses – It malformed XML to crash JADX/Apktool and disabled facial recognition to force PIN fallback (‘trigger parsing failures’ and ‘turn off native facial recognition’).jadx[T1629 ] Impair Defenses – It malformed XML to crash JADX/Apktool and disabled facial recognition to force PIN fallback (‘trigger parsing failures’ and ‘turn off native facial recognition’).
Countries
IndonesiaTelemetry found 19 unique samples affecting devices in Indonesia, Malaysia, the United States, Singapore, and Saudi Arabia.MalaysiaTelemetry found 19 unique samples affecting devices in Indonesia, Malaysia, the United States, Singapore, and Saudi Arabia.Saudi ArabiaTelemetry found 19 unique samples affecting devices in Indonesia, Malaysia, the United States, Singapore, and Saudi Arabia.SingaporeTelemetry found 19 unique samples affecting devices in Indonesia, Malaysia, the United States, Singapore, and Saudi Arabia.United StatesTelemetry found 19 unique samples affecting devices in Indonesia, Malaysia, the United States, Singapore, and Saudi Arabia.