Saturday, July 13, 2024

Stealthy Android Malware Attacking Mobile Users Via Fake App Stores

A recently discovered Android Trojan, dubbed “MMRat,” poses a serious threat to mobile banking security. Unlike other forms of malware, this Trojan is designed to evade detection from traditional antivirus software.

The security experts at TrendMicro have identified the Trojan as AndroidOS_MMRat.HRX, warning users to be cautious when downloading new apps or accessing their banking information from their Android devices.

This group has been committing bank fraud by targeting mobile users in Southeast Asia since late June 2023.

The sophisticated malware, operating under the package name, is equipped with advanced capabilities, including capturing user input, remote device control, and data exfiltration.

Infiltration and Distribution

MMRat utilizes deceptive phishing websites, posing as legitimate app stores, to distribute its payload. 

These phishing sites are tailored to specific language demographics, suggesting a targeted approach to victim selection. 

The exact mechanism of how these malicious links find their way to victims’ devices remains unclear. One notable aspect of MMRat’s infiltration is its complete evasion from detection. 

Even on VirusTotal, the malware has remained undetected, underscoring the effectiveness of its tactics.

The sequence of events involving MMRat’s bank fraud operations unfolds as follows:

  1. Victim downloads and installs MMRat.
  2. Victim grants necessary permissions.
  3. MMRat establishes communication with a remote server, sending substantial amounts of data, including personal and device-related information.

The threat actor can remotely wake up the device, unlock the screen, and initiate bank fraud. Additionally, they can visualize the device screen in real-time via screen capturing.

After accomplishing its fraudulent objectives, MMRat uninstalls itself, leaving minimal traces on the system.

             The MMRat attack sequence

Key Features of MMRat

Impersonation and Persistence MMRat disguises itself as an official app, presenting victims with phishing websites upon launch. It establishes a receiver for system events, ensuring persistence by launching a 1×1-sized pixel activity.

         Fake login website displayed by WebView

Network Communication MMRat communicates with a remote server through different ports, using a customized command-and-control (C&C) protocol based on protocol buffers (Protobuf). This unique approach enhances data transfer efficiency, which is particularly useful for transferring large data volumes.

The Protobuf schemas used for C&C communication

User Terminal State MMRat employs Android Accessibility to capture user actions and screen content. This unconventional method focuses on text data and bypasses the FLAG_SECURE protection.

Screen Capturing MMRat captures real-time screen content via the MediaProjection API and the “user terminal state” approach. It can stream screen content to a remote server in real-time, providing the threat actor with a live view of the device.

Remote Control The malware uses the Accessibility service to remotely control the victim’s device remotely, performing actions like gestures and inputting text. This aids in bank fraud execution.


Deploy Advanced AI-Powered Email Security Solution

Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware

Preventive Measures

To safeguard against MMRat and similar threats, users are advised to:

  1. Download apps only from official sources, such as Google Play Store or Apple App Store.
  2. Regularly update device software to benefit from security enhancements.
  3. Exercise caution while granting accessibility permissions and scrutinize app permissions.
  4. Install reputable security solutions on their devices.
  5. Be vigilant with personal and banking information shared online.

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.


Latest articles

mSpy Data Breach: Millions of Customers’ Data Exposed

mSpy, a widely used phone spyware application, has suffered a significant data breach, exposing...

Advance Auto Parts Cyber Attack: Over 2 Million Users Data Exposed

RALEIGH, NC—Advance Stores Company, Incorporated, a prominent commercial entity in the automotive industry, has...

Hackers Using ClickFix Social Engineering Tactics to Deploy Malware

Cybersecurity researchers at McAfee Labs have uncovered a sophisticated new method of malware delivery,...

Coyote Banking Trojan Attacking Windows Users To Steal Login Details

Hackers use Banking Trojans to steal sensitive financial information. These Trojans can also intercept...

Hackers Created 700+ Fake Domains to Sell Olympic Games Tickets

As the world eagerly anticipates the Olympic Games Paris 2024, a cybersecurity threat has...

Japanese Space Agency Spotted zero-day via Microsoft 365 Services

The Japan Aerospace Exploration Agency (JAXA) has revealed details of a cybersecurity incident that...

Top 10 Active Directory Management Tools – 2024

Active Directory Management Tools are essential for IT administrators to manage and secure Active...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles