Password-stealing malware sneaks in Google Play store in bogus apps

A cybercrime group has sneaked apps onto the official Google Play Store which then serve up Trojan banking malware to Android users, security researchers have revealed.

Uncovered in June, the campaign delivered Anubis malware designed to steal login credentials for banking apps, e-wallets and payment cards. The payload was hidden in applications which claimed to offer services ranging from online shopping to live stock-market monitoring.

The Android malware campaign has been unearthed and detailed by researchers at IBM X-Force, who suggest the effort put into making the applications look legitimate indicates "a large investment of resources on the part of the campaign's operator".

The malware seeemingly takes its name from Anubis, the Ancient Egyptian God of the dead.

As with other forms of Android malware uncovered in the Google Play app store, the malicious intent of Anubis is hidden away, with the payload only being delivered after the application is installed and in contact with a command-and-control server. Such is the stealthy nature of the malicious downloader, researchers say it isn't detected by antivirus software.

The developers of the malware are regularly altering the capabilities of the malware and will slightly alter the code to ensure that it isn't detected by Google Play's security controls. The regular updates are another sign which points to the malware being the work of a well-resourced criminal group.

Once BankBot Anubis has been delivered to the device the malware masquerades as an app called "Google Protect" which asks for accessibility rights. The malware authors are ultimately hoping that users will see the name Google on the display and inherently trust that the request is legitimate.

However, this is not the case and by granting accessibility rights, the malware is given permission to perform keylogging for the purposes of stealing infected user's credentials when they use a banking app or payment site. Anubis can also take screenshots of the user's display.

The campaign examined appears to specifically target Turkish users, but the configurations within Anubis show that it can be used to steal from users in countries around the world, including the US, UK, Australia, Israel, Japan and many more.
"Our research team suspects a cybercrime group operating in Turkey is behind this particular BankBot Anubis campaign. The downloaders themselves can also potentially be a cybercrime service offering distribution via Google Play," Limor Kessem, executive security advisor at IBM Security told ZDNet

It's thought that at least 10,000 people downloaded the malicious downloaders - although it's unknown how many of those have subsequently been infected with the malware.

IBM X-Force states that the malicious apps have been reported to Google for removal. ZDNet contacted Google, but hadn't received a reply at the time of writing.

Smartphones remain a popular target for cyber criminals because of the sheer amount of data they hold. In order to avoid falling victim to malware, users should only download trusted applications and should be mindful of what permissions the apps are requesting.