Monday, June 24, 2024

Android Banking Malware “Ginp” Steal Credit/Debit Card Info via Screen Overlay Attack To Empty Your Bank Money

Researchers uncovered a new form of sophisticated Android banking malware named “Ginp” targets Android users via screen overlay attack to steal banking credentials, SMS & credit/debit card details to empty victims’ bank account.

The Ginp malware initially spotted at the end of the Oct 2019 since then the malware is continuously under development, and 5 different versions of the Trojan released within 5 months of the period.

Attackers mainly interested in Spanish based bank users, also they are continuously releasing regular updates, and some evidence found that the Gip malware copying code from infamous Anubis banking Trojan

Ginp using multiple step overlay to avoid raising suspicion and the initial version was distributed via fake ” Google Play Verificator” app to steal the only incoming and outgoing SMS data.’

The next version has been released with a set of new features and spreading via masquerading as a fake “Adobe Flash Player” app to target some of the social and utility apps such as Google Play, Facebook, WhatsApp, Chrome, Skype, Instagram, and Twitter.

3 rd version of Ginp launched to focus on Banking sectors, and the attackers mainly target the 24 apps belongs to 7 different Spanish banks: Caixa bank, Bankinter, Bankia, BBVA, EVO Banco, Kutxabank and Santander.

Very recent version sophisticated than previous versions and the malware authors introduced an ability to grant the app the device admin permission and also added the new endpoint to download the additional module from C2 Server.

Ginp Malware Infection Process

Once the malware landed into the device, as a first step, it removes the icon and seeking the victim for the Accessibility Service privilege.

After permission granted, the Ginp itself grants some of the sensitive additional permission, such as send messages, and make calls, without requiring any further action from the victim.

Same as other banking trojans, Ginp Employed feature use of overlay attacks, SMS control, and contact list harvesting also uses the following set of features to fly under the radar and perform a successful attack.

  • Overlaying: Dynamic (local overlays obtained from the C2)
  • SMS harvesting: SMS listing
  • SMS harvesting: SMS forwarding
  • Contact list collection
  • Application listing
  • Overlaying: Targets list update
  • SMS: Sending
  • Calls: Call forwarding
  • C2 Resilience: Auxiliary C2 list
  • Self-protection: Hiding the App icon
  • Self-protection: Preventing removal
  • Self-protection: Emulation-detection

According to Threat Fabric research, “By abusing the accessibility service, Ginp determine which apps running in the background. Something that makes Ginp special is that all of its overlay screens for banking apps are consist of multiple steps, first stealing the victim’s login credentials, then stealing the credit card details”

It targets various social media apps, such as Facebook, WhatsApp, Skype, Twitter, Chrome, Instagram, Snapchat and implements the generic credit card grabber overlay screen to harvest the card number, CVV, Date.

Researchers confirmed that the currently active version targeting a total of 24 unique apps. “In a 5-month timespan, the actor managed to create a Trojan from scratch which will presumably continue evolving offering new features such as keylogging, back-connect proxy or RAT capabilities.” Researcher said.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

Threat Actor Claiming a 0-day in Linux LPE Via GRUB bootloader

A new threat actor has emerged, claiming a zero-day vulnerability in the Linux GRUB...

LockBit Ransomware Group Claims Hack of US Federal Reserve

The notorious LockBit ransomware group has claimed responsibility for hacking the U.S. Federal Reserve,...

Microsoft Power BI Vulnerability Let Attackers Access Organizations Sensitive Data

A vulnerability in Microsoft Power BI allows unauthorized users to access sensitive data underlying...

Consulting Companies to Pay $11 Million Failing Cybersecurity Requirements

Two consulting companies, Guidehouse Inc. and Nan McKay and Associates, have agreed to pay...

New RAT Malware SneakyChef & SugarGhost Attack Windows Systems

Talos Intelligence has uncovered a sophisticated cyber campaign attributed to the threat actor SneakyChef....

Chinese Winnti Group Intensifies Financially Motivated Attacks

Hackers are increasingly executing financially motivated attacks and all due to the lucrative potential...

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from for...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles