Password-stealing malware sneaks in Google Play store in bogus apps

A cybercrime group has sneaked apps onto the official Google Play Store which then serve up Trojan banking malware to Android users, security researchers have revealed.
Uncovered in June, the campaign delivered Anubis malware designed to steal login credentials for banking apps, e-wallets and payment cards. The payload was hidden in applications which claimed to offer services ranging from online shopping to live stock-market monitoring.
The Android malware campaign has been unearthed and detailed by researchers at IBM X-Force, who suggest the effort put into making the applications look legitimate indicates "a large investment of resources on the part of the campaign's operator".
The malware seeemingly takes its name from Anubis, the Ancient Egyptian God of the dead.
As with other forms of Android malware uncovered in the Google Play app store, the malicious intent of Anubis is hidden away, with the payload only being delivered after the application is installed and in contact with a command-and-control server. Such is the stealthy nature of the malicious downloader, researchers say it isn't detected by antivirus software.
The developers of the malware are regularly altering the capabilities of the malware and will slightly alter the code to ensure that it isn't detected by Google Play's security controls. The regular updates are another sign which points to the malware being the work of a well-resourced criminal group.
Once BankBot Anubis has been delivered to the device the malware masquerades as an app called "Google Protect" which asks for accessibility rights. The malware authors are ultimately hoping that users will see the name Google on the display and inherently trust that the request is legitimate.
However, this is not the case and by granting accessibility rights, the malware is given permission to perform keylogging for the purposes of stealing infected user's credentials when they use a banking app or payment site. Anubis can also take screenshots of the user's display.
The campaign examined appears to specifically target Turkish users, but the configurations within Anubis show that it can be used to steal from users in countries around the world, including the US, UK, Australia, Israel, Japan and many more.
"Our research team suspects a cybercrime group operating in Turkey is behind this particular BankBot Anubis campaign. The downloaders themselves can also potentially be a cybercrime service offering distribution via Google Play," Limor Kessem, executive security advisor at IBM Security told ZDNet
It's thought that at least 10,000 people downloaded the malicious downloaders - although it's unknown how many of those have subsequently been infected with the malware.
IBM X-Force states that the malicious apps have been reported to Google for removal. ZDNet contacted Google, but hadn't received a reply at the time of writing.
Smartphones remain a popular target for cyber criminals because of the sheer amount of data they hold. In order to avoid falling victim to malware, users should only download trusted applications and should be mindful of what permissions the apps are requesting.

Views: 165

©ictnews.az. All rights reserved.

Facebook Google Favorites.Live BobrDobr Delicious Twitter Propeller Diigo Yahoo Memori MoeMesto

16 February 2019

15 02 2019

Thousands of Android Apps Break Google’s Privacy Rules

Researchers from the International Computer Science Institute (ICSI) examined 24,000 Android apps and found 

Artificial leaves to help fight global warming

Thanks to a breakthrough design by researchers at the University of Illinois at Chicago, artificial leaves are ready

‘Saghlamlig 2018’ Republican Spartakiada holds its last competition

A table tennis competition was held as part of the "Saghlamlig (Health) 2018" Republican Spartakiada.

Indian government wants to slide into users’ WhatsApp messages

Over 250 million Indians use WhatsApp for communication each day. With so much information being sent daily,

Criminals will soon be caught using just pictures of their hands

Scientists are working on a piece of technology that will catch criminals using pictures of their hands.

Instagram direct messaging could be coming to browsers, desktop

Instagram's apparently working on making its direct messaging available on desktop apps and web browsers.

ESET observes rise in activity of Shade ransomware

Russia has been hit by a ransomware campaign with the malware Troldesh (aka Shade). It has been discovered