A new trojan for iOS and Android has been discovered that uses its capabilities to scan the victim’s face for apparent use in future deepfakes. The trojan, named “GoldPickaxe”, is the latest strain of malware developed by the Chinese threat actor group “GoldFactory”, seen targeting users in Southeast Asia. Victims are initially contacted via the LINE instant messaging application by threat actors pretending to be from their respective government. The threat actor then attempts to convince the victim to download a fake pension application from a webpage designed to impersonate the Google Play Store. For iOS users, the threat actor takes a more roundabout approach, attempting to get the user to download a Mobile Device Management (MDM) profile that then downloads the application from a website. This method allows the threat actor to have a great deal of access to the device as MDMs give them a myriad of abilities to utilize, including application management. Once installed, the malware has the ability to contact threat actor-controlled command-and-control (C2) servers, scrape system information from the device, exfiltrate recent photos, and more. GoldPickaxe also requests the user to take a video of their face so they can complete their online bank profile for either a banking institution or a government pension system. It is believed that this is a direct response to financial institutions leveraging biometric safeguards on currency transfers over certain limits. The stolen photos and use of a facial video would allow threat actors to use modern AI technology to create deepfakes of the individual they are attempting to transfer money from. This sophisticated phishing technique allows the threat actor to associate bank accounts or pension numbers with the individual through scraped information and then steal the money using intercepted information and deepfake videos. CTIX analysts will continue to monitor the use of stolen biometric information to create deepfakes for scams and security bypasses as the technology continues to evolve.