Categories: Malware

Banking Malware posed as a Popular Social Media App to Steal Financial Data From Online Banking Systems

Newly discovered Two Android Banking Trojan posed as popular social Media and banking apps to steal the victim’s financial information from online banking and payment systems

Android Banking Trojan’s mainly targeting the financial sector such as bank and other financial institutions and compromising it to steal sensitive information such as username, password and credit card data.

It mimics as popular social media apps such as WhatsApp, Facebook, Skype, Instagram, Twitter and other India based banking apps.

Malicious Android Applications are using fake ICON’s to trick users to install it on to the victim’s device.

How Does This Banking Trojan Attack Works

Initially victims download the malicious apps downloaded from third-party app stores or links provided in SMS’s or emails and pornographic websites.

Once it downloads and installed into the vicitms computer the malware gain access to special privileges by forcing the user to select the ‘Activate’ button.

The malicious application requested to Activate the device administrator to gain the complete control of the infection victims device.

If the user will press the CANCEL button, the app will keep asking Press the ACTIVATE  button to gain the special permission as you can see the above Picture.

Also, this malware having a list of apps that imitate as a legitimate apps and search it in the infected victim’s device after gaining the special permission.

According to Quickheal,  if the user opens any of these apps (banking or social media), the Trojan displays a fake window asking for a credit/debit card number. Unless this number is provided, this window prevents the user from accessing the app

Once the infected users will provide a card number and other relevant information that requested by this Trojan, then it will share the gathered information to the attacker via Command & Control server.

Mitigation

  1. Avoid downloading apps from third-party app stores or links provided in SMS or emails.
  2. Always keep ‘Unknown Sources’ disabled. Enabling this option allows installation of apps from third-party sources.
  3. Keep Play Protection service ‘ON’
  4. Verify app permissions before installing any app even from official stores such as Google Play.

Also Read:

Dangerous PANDA Banking Malware Spreads Through Phishing Attacks Targets Banks, Cryptocurrency Sites and Social Media

New Malicious dropper Spreading Dangerous “Bankbot” Banking Malware via Google Play store

New Dangerous Android Permission Security Flaw leads to Ransomware and Banking Malware Attacks

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…

1 day ago

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…

3 days ago

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…

3 days ago

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…

3 days ago

Google Chrome Security, Critical Vulnerabilities Patched

Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…

4 days ago

Notorious WrnRAT Delivered Mimic As Gambling Games

WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…

4 days ago