Tuesday, March 5, 2024

New Weaponized Android Apps With 1M Installs Steals 2FA Codes & Passwords

Android Malware Steals 2FA Codes. Check Point Research has recently published a study revealing the discovery of a previously unknown malware variant dubbed FluHorse.

The malware comprises multiple malicious Android apps that impersonate legitimate ones, and unfortunately, most of these fake apps have already been installed by over 1,000,000 users.

All these malicious applications are designed to steal victims’ credentials and 2FA codes, compromising their personal and sensitive information.

FluHorse targets various industries across the Eastern Asian market and is distributed through email.

These attacks can prove persistent, dangerous, and challenging to detect, as they often leverage email accounts belonging to high-profile entities during the initial stages.

Mimicked Apps

Attackers find applications that mimic trusted, reputable companies particularly enticing since they are likely to attract financially capable customers. 

The legitimacy of these copied applications makes them even more appealing to hackers.

  • ETC with 1,000,000+ Google Play installsVPBank
  • Neo with 1,000,000+ Google Play installs

According to the ETC APK developer’s website, the application generates approximately 16 million transactions daily, with over 6 million users relying on its services.

VPBank, a major private bank in Vietnam, recorded total assets surpassing 631 trillion dongs as of December 2022, cementing its position as one of the country’s biggest financial institutions.

While the enterprise encompasses a diverse range of financial services like:-

  • Spanning retail
  • Corporate
  • Consumer Finance
  • Wealth management operations

Also, experts have noted the presence of other malicious dating applications’ presence. However, they have not discovered any corresponding applications that the malware attempts to impersonate.

Targeted banks

Infection Chain

The malicious applications contain nothing beyond multiple window replicas that offer the victim input options.

While the scheme’s effectiveness remains undisputed, regardless of the attackers’ intentions, once the victim enters their sensitive data, the information is swiftly exfiltrated to the command and control (C&C) server.

Upon reaching this step, the SMS interception feature takes over, redirecting all incoming SMS traffic to the server under the attacker’s control.

The malware actors intercept any Two Factor Authentication (2FA) codes when prompted in the event they have already entered stolen credentials or credit card data.

Attack Chain

Moreover, the email lures serve as an effective social engineering tactic and are consistent with the supposed intent of the malicious APK (like paying tolls) installed afterward.

Cloned apps

To achieve the objective, assessing Flutter-based applications requires intermediate steps compared to analyzing pure Android apps.

The Flutter framework uses a custom virtual environment that enables developers to develop across multiple platforms using a single code set.

The Flutter platform utilizes a particular programming language called Dart for its development. At the same time, the availability of the Flutter platform code as an open-source project makes analysis somewhat more straightforward.

Toolchain

The malicious samples have multiple layers of technical implementation.

Despite the simple, functional aspect, analysts deduce that the malware developers utilized Flutter as a developing platform, indicating minimal programming effort.

Since May 2022, FluHorse activity has been under the radar of cybersecurity researchers.

Their analysis reveals the persistent danger of these campaigns as fresh infrastructure nodes and malicious applications surface every month.

Website

Latest articles

GTPDOOR – Previously Unknown Linux Malware Attack Telecom Networks

Researchers have discovered a new backdoor named GTPDOOR that targets telecommunication network systems within...

US Court Orders NSO Group to Handover Code for Spyware, Pegasus to WhatsApp

Meta, the company that owns WhatsApp, filed a lawsuit against NSO Group in 2019....

New SSO-Based Phishing Attack Trick Users into Sharing Login Credentials  

Threat actors employ phishing scams to trick individuals into giving away important details like...

U.S. Charged Iranian Hacker, Rewards up to $10 Million

The United States Department of Justice (DoJ) has charged an Iranian national, Alireza Shafie...

Huge Surge in Ransomware-as-a-Service Attacks targeting Middle East & Africa

The Middle East and Africa (MEA) region has witnessed a surge in ransomware-as-a-service (RaaS)...

New Silver SAML Attack Let Attackers Forge Any SAML Response To Entra ID

SolarWinds cyberattack was one of the largest attacks of the century in which attackers...

AI Worm Developed by Researchers Spreads Automatically Between AI Agents

Researchers have developed what they claim to be one of the first generative AI...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles