{"id":20156,"date":"2022-09-21T09:01:06","date_gmt":"2022-09-21T17:01:06","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2022\/09\/21\/news-13889\/"},"modified":"2022-09-21T09:01:06","modified_gmt":"2022-09-21T17:01:06","slug":"news-13889","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2022\/09\/21\/news-13889\/","title":{"rendered":"Rewards plus: Fake mobile banking rewards apps lure users to install info-stealing RAT on Android devices"},"content":{"rendered":"

Credit to Author: Microsoft 365 Defender Threat Intelligence Team| Date: Wed, 21 Sep 2022 17:00:00 +0000<\/strong><\/p>\n

Our analysis of a recent version of a previously reported info-stealing Android malware, delivered through an ongoing SMS campaign, demonstrates the continuous evolution of mobile threats. Masquerading as a banking rewards app, this new version has additional remote access trojan (RAT) capabilities, is more obfuscated, and is currently being used to target customers of Indian banks. The SMS campaign sends out messages containing a link that points to the info-stealing Android malware. The malware\u2019s RAT capabilities allow the attacker to intercept important device notifications such as incoming messages, an apparent effort to catch two-factor authentication (2FA) messages often used by banking and financial institutions. The malware\u2019s ability to steal all SMS messages is also concerning since the data stolen can be used to further steal users\u2019 sensitive info like 2FA messages for email accounts and other personally identifiable information (PII).<\/p>\n

\"This
Figure 1. Typical SMS campaign attack flow<\/em><\/figcaption><\/figure>\n

Our investigation of this new Android malware version started from our receipt of an SMS message containing a malicious link that led us to the download of a fake banking rewards app. The fake app, detected as TrojanSpy:AndroidOS\/Banker.O, used a different bank name and logo compared to a similar malware reported in 2021<\/a>. Moreover, we found that this fake app\u2019s command and control (C2) server is related to 75 other malicious APKs based on open-source intelligence. Some of the malicious APKs also use the same Indian bank\u2019s logo as the fake app that we investigated, which could indicate that the actors are continuously generating new versions to keep the campaign going.<\/p>\n

This blog details our analysis of the recent version\u2019s capabilities. We strongly advise users never to click on unknown links received in SMS messages, emails, or messaging apps. We also recommend seeking your bank\u2019s support or advice on digital options for your bank. Further, ensure that your banking apps are downloaded from official app stores to avoid installing malware.<\/p>\n

Observed activity<\/h2>\n

What the user sees<\/h3>\n

We have seen other campaigns targeting Indian banks\u2019 customers based on the following app names:<\/p>\n