Yesterday the researchers of ESET, a famous antivirus, released a report on two Android scam app, one impersonating the Trezor wallet and the other a multi wallet.
The indicted apps are Trezor Mobile Wallet and Coin Wallet which have been properly removed from the Google store.
While the application page on Google Play seemed legitimate, the researchers said that the software itself does not contain any Trezor trademark, with a generic phishing login screen for credentials.
According to ESET, more than 1,000 users have downloaded one of the applications
These are the words of one of the ESET researchers, Lukáš Štefanko:
“The app claims it lets its users create wallets for various cryptocurrencies. However, its actual purpose is to trick users into transferring cryptocurrency into the attackers’ wallets – a classic case of what we’ve named wallet address scams in our previous research into cryptocurrency-targeting malware” .
Unfortunately, it’s not the first time for Trezor: the official app for this device is on the official GitHub page at the following address and not on the Google store, this creates a lot of confusion especially for new and inexperienced users.
The Trezor teams confirmed the false nature of this application and reassured that the device will not be compromised by it, even though since its launch on the store in February of this year, it has been deleted far too late, causing many users considerable losses.
Trezor told the researchers that the false application does not seem to pose a threat to the security of its users but the company is not hiding its concern.
