Monday, April 28, 2025
HomeMalwareFakebank Malware Variant that Intercepts Android user's Banking Calls

Fakebank Malware Variant that Intercepts Android user’s Banking Calls

Published on

SIEM as a Service

Follow Us on Google News

The Fakebank malware comes back, with its new Fakebank malware variant that intercepts the Android users’ banking incoming and outgoing calls. Attackers distributed the app through third-party Android markets and social media websites.

Security researchers from Symantec identified the malicious behavior of the apps infected with Android.Fakebank that intercepts the calls made by the users to their banks.

With the current variant it targets Korean bank clients, so far 22 apps have been identified infected with the Fakebank malware. The previous variant of the Fakebank malware intercepts the SMS applications to gather financial information.

- Advertisement - Google News

The previous version of the Fakebank malware variant targets Russian speaking nations and Russian banks with high Obfuscation technique to steal highly sensitive information.

Fakebank Malware Variant

When the app triggered it collects the personal information from user’s phone and submits to the command and control servers. The server responds with the configuration that specifies the phone number.

Fakebank Malware
Researchers said “When users call a real banking phone number, the malware is able to intercept and transfer the call to the scammer’s configured phone number. When a call comes in from a scammer, the app will overlay a fake UI dialog that spoofs a legitimate bank caller ID and number”.

The API and associated permissions evolved based on the Android versions (android.permission.SYSTEM_ALERT_WINDOW). With Android version’s below 6 the permission needs to be declared in the manifest file and it requires permission at the time of installation.

With Android version 6 & 7 if the permission declared in the manifest file and the app downloaded from Google Play, it won’t prompt users for permission. From the Android version 8, the app is not allowed to overlay system so the malware will not execute.

Common Defences On Mobile Threats

  • Give careful consideration to the permission asked for by applications.
  • Download applications from trusted sources.
  • Stay up with the latest version.
  • Encrypt your devices.
  • Make frequent backups of important data.
  • Install anti-malware on their devices.
  • Stay strict with CIA Cycle.
Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

RansomHub Ransomware Deploys Malware to Breach Corporate Networks

The eSentire’s Threat Response Unit (TRU) in early March 2025, a sophisticated cyberattack leveraging...

19 APT Hackers Target Asia-based Company Servers Using Exploited Vulnerabilities and Spear Phishing Email

The NSFOCUS Fuying Laboratory’s global threat hunting system identified 19 sophisticated Advanced Persistent Threat...

FBI Reports ₹1.38 Lakh Crore Loss in 2024, a 33% Surge from 2023

The FBI’s Internet Crime Complaint Center (IC3) has reported a record-breaking loss of $16.6...

Fog Ransomware Reveals Active Directory Exploitation Tools and Scripts

Cybersecurity researchers from The DFIR Report’s Threat Intel Group uncovered an open directory hosted...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

RansomHub Ransomware Deploys Malware to Breach Corporate Networks

The eSentire’s Threat Response Unit (TRU) in early March 2025, a sophisticated cyberattack leveraging...

Advanced Multi-Stage Carding Attack Hits Magento Site Using Fake GIFs and Reverse Proxy Malware

A multi-stage carding attack has been uncovered targeting a Magento eCommerce website running an...

Hannibal Stealer: Cracked Variant of Sharp and TX Malware Targets Browsers, Wallets, and FTP Clients

A new cyber threat, dubbed Hannibal Stealer, has surfaced as a rebranded and cracked...