Password-stealing malware sneaks in Google Play store in bogus apps

A cybercrime group has sneaked apps onto the official Google Play Store which then serve up Trojan banking malware to Android users, security researchers have revealed.
Uncovered in June, the campaign delivered Anubis malware designed to steal login credentials for banking apps, e-wallets and payment cards. The payload was hidden in applications which claimed to offer services ranging from online shopping to live stock-market monitoring.
The Android malware campaign has been unearthed and detailed by researchers at IBM X-Force, who suggest the effort put into making the applications look legitimate indicates "a large investment of resources on the part of the campaign's operator".
The malware seeemingly takes its name from Anubis, the Ancient Egyptian God of the dead.
As with other forms of Android malware uncovered in the Google Play app store, the malicious intent of Anubis is hidden away, with the payload only being delivered after the application is installed and in contact with a command-and-control server. Such is the stealthy nature of the malicious downloader, researchers say it isn't detected by antivirus software.
The developers of the malware are regularly altering the capabilities of the malware and will slightly alter the code to ensure that it isn't detected by Google Play's security controls. The regular updates are another sign which points to the malware being the work of a well-resourced criminal group.
Once BankBot Anubis has been delivered to the device the malware masquerades as an app called "Google Protect" which asks for accessibility rights. The malware authors are ultimately hoping that users will see the name Google on the display and inherently trust that the request is legitimate.
However, this is not the case and by granting accessibility rights, the malware is given permission to perform keylogging for the purposes of stealing infected user's credentials when they use a banking app or payment site. Anubis can also take screenshots of the user's display.
The campaign examined appears to specifically target Turkish users, but the configurations within Anubis show that it can be used to steal from users in countries around the world, including the US, UK, Australia, Israel, Japan and many more.
"Our research team suspects a cybercrime group operating in Turkey is behind this particular BankBot Anubis campaign. The downloaders themselves can also potentially be a cybercrime service offering distribution via Google Play," Limor Kessem, executive security advisor at IBM Security told ZDNet
It's thought that at least 10,000 people downloaded the malicious downloaders - although it's unknown how many of those have subsequently been infected with the malware.
IBM X-Force states that the malicious apps have been reported to Google for removal. ZDNet contacted Google, but hadn't received a reply at the time of writing.
Smartphones remain a popular target for cyber criminals because of the sheer amount of data they hold. In order to avoid falling victim to malware, users should only download trusted applications and should be mindful of what permissions the apps are requesting.

Views: 122

©ictnews.az. All rights reserved.

Facebook Google Favorites.Live BobrDobr Delicious Twitter Propeller Diigo Yahoo Memori MoeMesto

23 September 2018

22 09 2018

Penetration of AI accelerating solutions in smartphones to surpass 30% in 2018, says Digitimes Research

Since both HiSilicon's Kirin 980 and Apple's A12 Bionic application processors come with AI (artificial intelligence) accelerators, the penetr

Instagram is testing geo-restriction for stories and posts

Instagram is testing a geofencing feature for stories and posts. This will allow the creators to post their content to selected countries, instead of

ZeroDayLab Discovers EE Local Privilege Escalation Vulnerability CVE-2018-14327

EE forms part of BT Group, the largest digital communications company in UK, and boasts of serving more than 31 million connections across its mobile