Malicious Weather App has been discovered by ESET Malware Research Team in google play store which can spy your Android phone and easily lock / unlock your Phone by break the existing pattern/Password.
This application Primarily having their mobile banking app compromised.Detected by ESET as Trojan.Android/Spy.Banker.HU, the malware was a trojanized version of the otherwise benign weather forecast application Good Weather.
This app published in the store on February 4th 2017.ESET mention in their Blog ,that they discovered in very short time period since the app has uploaded in google play.
The trojan has been targeting 22 Turkish banking apps and has so far been downloaded by about 5,000 victims.
Once downloaded the malware has the ability to lock, unlock and intercept texts from the device, as well as, deliver the local weather. The malware accesses the victim’s banking credentials with its command-and-control server and is able to avoid the bank’s two-factor authentication system because it controls all text functionality.
According to ESET Explained the working Functions as “After the app is installed by an unsuspecting user, its weather-themed icon disappears. The infected device then displays a fake system screen requesting device administrator rights on behalf of fictitious “System update”. By enabling these rights, the victim allows the malware to Change the screen-unlock password and Lock the screen. “
legitimate Good Weather icon, Red – malicious version
ESET explined in Blog Post ,
Users who are not alarmed at this point might be pleased with the new weather widget they can add to their home screens. However, in the background, the malware is getting to work sharing device information with its C&C server.ESET Researcher’s Said ,The trojan displays a fake login screen once the user runs one of the targeted banking apps and sends entered data to the attacker. Thanks to the permission to intercept the victims’ text messages, the malware is also able to bypass SMS-based two-factor authentication.
As for the device locking, we suspect this function enters the picture when cashing out the compromised bank account, to keep the fraudulent activity hidden from the user. Once locked out, all victims can do is wait until the malware receives a command to unlock the device.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…