Malware researcher Lukas Stefanko discovered four counterfeit cryptocurrency wallets on Google’s Play Store that were attempting to steal users’ personal data. A blog post published on November 13 reports the apps were posing as cryptocurrency wallets for NEO, Tether and an extension for accessing Ethereum (ETH), MetaMask. The apps were reportedly designed to steal confidential information, including mobile banking credentials and credit card information.

Stefanko classified the four wallets into two groups, in which the MetaMask app was a “phishing wallet” and the other three apps were “fake wallets.” Once the phishing app is installed and opened, it requests the user’s private key and wallet password. Stefanko further explained his research regarding the “fake wallets”  in a video attached to the blog post, noting the example of the fake NEO app dubbed “Neo Wallet,” which had over 1,000 installs since its launch in October.

The fake crypto wallets did not create a new wallet through generating a public address and a private key, which is needed to securely send and receive digital currency – but only displayed the attacker’s public address with no user access to the private key. Convinced that the app generated users’ public address, users would deposit their funds to the fake wallet, but were unable to withdraw them as the private key belonged to a cybercriminal.

Stefanko mentioned that the apps were developed using the Drag-n-Drop app builder service, which Cointelegraph notes does not require particular coding knowledge from a user. Further meaning almost anyone is able to “develop” a simple malicious app to steal sensitive personal data, “once the Bitcoin (BTC) price rises,” according to Stefanko.