Monday, June 16, 2025
HomeAndroidAndroid Banking Malware "Ginp" Steal Credit/Debit Card Info via Screen Overlay Attack...

Android Banking Malware “Ginp” Steal Credit/Debit Card Info via Screen Overlay Attack To Empty Your Bank Money

Published on

SIEM as a Service

Follow Us on Google News

Researchers uncovered a new form of sophisticated Android banking malware named “Ginp” targets Android users via screen overlay attack to steal banking credentials, SMS & credit/debit card details to empty victims’ bank account.

The Ginp malware initially spotted at the end of the Oct 2019 since then the malware is continuously under development, and 5 different versions of the Trojan released within 5 months of the period.

Attackers mainly interested in Spanish based bank users, also they are continuously releasing regular updates, and some evidence found that the Gip malware copying code from infamous Anubis banking Trojan

- Advertisement - Google News

Ginp using multiple step overlay to avoid raising suspicion and the initial version was distributed via fake ” Google Play Verificator” app to steal the only incoming and outgoing SMS data.’

The next version has been released with a set of new features and spreading via masquerading as a fake “Adobe Flash Player” app to target some of the social and utility apps such as Google Play, Facebook, WhatsApp, Chrome, Skype, Instagram, and Twitter.

3 rd version of Ginp launched to focus on Banking sectors, and the attackers mainly target the 24 apps belongs to 7 different Spanish banks: Caixa bank, Bankinter, Bankia, BBVA, EVO Banco, Kutxabank and Santander.

Very recent version sophisticated than previous versions and the malware authors introduced an ability to grant the app the device admin permission and also added the new endpoint to download the additional module from C2 Server.

Ginp Malware Infection Process

Once the malware landed into the device, as a first step, it removes the icon and seeking the victim for the Accessibility Service privilege.

After permission granted, the Ginp itself grants some of the sensitive additional permission, such as send messages, and make calls, without requiring any further action from the victim.

Same as other banking trojans, Ginp Employed feature use of overlay attacks, SMS control, and contact list harvesting also uses the following set of features to fly under the radar and perform a successful attack.

  • Overlaying: Dynamic (local overlays obtained from the C2)
  • SMS harvesting: SMS listing
  • SMS harvesting: SMS forwarding
  • Contact list collection
  • Application listing
  • Overlaying: Targets list update
  • SMS: Sending
  • Calls: Call forwarding
  • C2 Resilience: Auxiliary C2 list
  • Self-protection: Hiding the App icon
  • Self-protection: Preventing removal
  • Self-protection: Emulation-detection

According to Threat Fabric research, “By abusing the accessibility service, Ginp determine which apps running in the background. Something that makes Ginp special is that all of its overlay screens for banking apps are consist of multiple steps, first stealing the victim’s login credentials, then stealing the credit card details”

It targets various social media apps, such as Facebook, WhatsApp, Skype, Twitter, Chrome, Instagram, Snapchat and implements the generic credit card grabber overlay screen to harvest the card number, CVV, Date.

Researchers confirmed that the currently active version targeting a total of 24 unique apps. “In a 5-month timespan, the actor managed to create a Trojan from scratch which will presumably continue evolving offering new features such as keylogging, back-connect proxy or RAT capabilities.” Researcher said.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Kali Linux 2025.2 Released: New Tools, Smartwatch and Car Hacking Added

Kali Linux, the preferred distribution for security professionals, has launched its second major release...

Arsen Launches AI-Powered Vishing Simulation to Help Organizations Combat Voice Phishing at Scale

Arsen, the cybersecurity startup known for defending organizations against social engineering threats, has announced...

NIST Releases New Guide – 19 Strategies for Building Zero Trust Architectures

The National Institute of Standards and Technology (NIST) has released groundbreaking guidance to help...

Spring Framework Flaw Enables Remote File Disclosure via “Content‑Disposition” Header

A medium-severity reflected file download (RFD) vulnerability (CVE-2025-41234) in VMware's Spring Framework has been...

Credential Abuse: 15-Min Attack Simulation

Credential Abuse Unmasked

Credential abuse is #1 attack vector in web and API breaches today (Verizon DBIR 2025). Join our live, 15-min attack simulation with Karthik Krishnamoorthy (CTO - Indusface) and Phani Deepak Akella (VP of Marketing - Indusface) to see hackers move from first probe to full account takeover.

Discussion points


Username & email enumeration – how a stray status-code reveals valid accounts.
Password spraying – low-and-slow guesses that evade basic lockouts.
Credential stuffing – lightning-fast reuse of breach combos at scale.
MFA / session-token bypass – sliding past second factors with stolen cookies.

More like this

Cybercriminals Exploiting Expired Discord Invite Links to Deploy Multi-Stage Malware

Recent investigations by Check Point Research have uncovered a sophisticated malware campaign that leverages...

Interpol Dismantles 20,000 Malicious IPs and Domains Tied to 69 Malware Variants

In a landmark global cybercrime crackdown, INTERPOL’s Operation Secure has seen the takedown of...

New Secure Boot Vulnerability Allows Attackers to Install Malware in PC and Server Boot Processes

Security researchers from Binarly have uncovered a major software vulnerability in the Unified Extensible...