Game-Changer: Biometric-Stealing Malware

This report warns of GoldPickaxe.iOS, an iOS trojan from the GoldFactory actor that harvests facial biometrics, identity documents and SMS to create AI-driven deepfake identities for remote account takeover against Asia-Pacific banks; it details how stolen biometrics can be weaponized using device emulators and virtual cameras, emphasizes the irreversible nature of biometric compromise, and recommends defenses including user education, pairing biometrics with physical authenticators (e.g., FIDO2), and transforming/storing biometric data so stolen copies are useless off-device.