An updated version of the Banker Android (opens in new tab) spyware has been detetcted, stealing victim's banking details and possibly even money in some cases.
According to cybersecurity researchers from Microsoft (opens in new tab), an unknown threat actor has initiated a smishing campaign (SMS phishing), through which it tries to trick people into downloading TrojanSpy:AndroidOS/Banker.O. This is a malware (opens in new tab) variant that’s capable of extracting all sorts of sensitive information, including two-factor authentication (2FA) codes, account login details, and other personally identifiable information (PII).
What makes this attack particularly worrying is how stealthily the entire operation works.
Granting major permissions
Once the user downloads the malware, they need to grant certain permissions, such as MainActivity, AutoStartService, and RestartBroadCastReceiverAndroid.
That allows it to intercept calls, access call logs, messages, contacts, and even network information. By being able to do these things, the malware can also receive and read two-factor authentication codes coming in via SMS, and delete them to make sure the victim doesn’t suspect anything fishy.
To make matters even worse, the app is allowed silent command, which means the 2FA codes coming in through SMS can be received, read, and deleted, in complete silence – no notification sounds, no vibration, no screen light, nothing.
The threat actors behind the campaign are unknown, but what Microsoft does know is that the app, first seen in 2021, and significantly upgraded since, can be accessed remotely.
The scope of the attack is also unknown, as it’s hard to determine exactly how many people are affected. Last year, Banker was observed attacking Indian consumers only, and given that the phishing SMS carries the logo of the Indian ICICI bank, it’s safe to assume Indian users are in the crosshairs this time around, as well.
“Some of the malicious APKs also use the same Indian bank's logo as the fake app that we investigated, which could indicate that the actors are continuously generating new versions to keep the campaign going,” the researchers said.
Via: The Register (opens in new tab)
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba