CYBER researchers have unearthed two dodgy Android apps that are designed to empty your bank account.
The software is dressed up as harmless antivirus apps that are freely available on the Google Play Store.
3
3
However, once downloaded, they install malware onto the device that steals your online banking logins.
Details of the malware were featured in a report this week from Fox-IT, a division of cyber security company NCC Group.
It follows the discovery of six examples of the malware, which is known as SharkBotDropper, on the Play Store back in April.
Now an additional two with more than 60,000 downloads between them appear to have slipped through Google’s security checks.
The apps discovered by Fox-IT are:
- Mister Phone Cleaner (50,000+ downloads)
- Kylhavy Mobile Security (10,000+ downloads)
Google has since removed the bunch, but that doesn’t protect anyone who’s already downloaded them.
If you have them installed on your phone, you should remove the apps immediately and consider changing your passwords.
If users have installed either of these apps, Sharkbot can pinch their online banking credentials in a number of ways.
Most read in Tech news
It’s a banking trojan known for luring victims into entering their login details in spoofed popups.
The precious data is then secretly sent off to hackers who can then access everything including emails, social media and banking accounts.
The trojan can reportedly also steal online logins by logging key presses and by letting attackers remotely access infected devices.
Once they have access to your online bank account, they can set transfers in motion.
Hackers ‘speak Russian’
Experts at discovered six apps loaded with the malware back in April.
The dubious apps were downloaded more than 11,000 times, according to Check Point Research who uncovered the scam.
More than a third of victims are believed to be from the UK and the rest have been mostly traced back to Italy.
They have since been removed from the Play Store.
Experts assume the perpetrators speak Russian from their investigation.
Adding to suspicion, they noticed the apps were programmed not to work against anyone located in China, India, Romania, Russia, Ukraine or Belarus.
But, they said they don’t have enough evidence to point the finger at who exactly is behind it.
“Looking at the install count we can assume that the threat actor hit the bulls-eye for their method of malware spread,” said Alexander Chailytko, a cyber security at Check Point Software.
“The threat actor strategically chose a location of applications on Google Play that have users’ trust.
“What’s also noteworthy here is that the threat actors push messages to victims containing malicious links, which leads to widespread adoption.
“All in all, the use of push-messages by the threat actors requesting an answer from users is an unusual spreading technique.
“I think it’s important for all Android users to know that they should think twice before downloading any antivirus solution from the Play Store.”
3
Best Phone and Gadget tips and hacks
Looking for tips and hacks for your phone? Want to find those secret features within social media apps? We have you covered…
We pay for your stories! Do you have a story for The Sun Online Tech & Science team? Email us at [email protected]
This post first appeared on Thesun.co.uk
