Cybersecurity researchers on Monday took the wraps off a brand new Android trojan that takes benefit of accessibility options on the units to siphon credentials from banking and cryptocurrency companies in Italy, the U.Ok., and the U.S.
Dubbed “SharkBot” by Cleafy, the malware is designed to strike a complete of 27 targets — counting 22 unnamed worldwide banks in Italy and the U.Ok. in addition to 5 cryptocurrency apps within the U.S. — at the least since late October 2021 and is believed to be in its early phases of growth, with no overlaps discovered to that of any recognized households.
“The principle purpose of SharkBot is to provoke cash transfers from the compromised units by way of Automated Switch Programs (ATS) method bypassing multi-factor authentication mechanisms (e.g., SCA),” the researchers stated in a report.
“As soon as SharkBot is efficiently put in within the sufferer’s system, attackers can receive delicate banking info by way of the abuse of Accessibility Companies, akin to credentials, private info, present steadiness, and so forth., but in addition to carry out gestures on the contaminated system.”
Masquerading as a media player, dwell TV, or information restoration apps, SharkBot, like its different malware counterparts TeaBot and UBEL, repeatedly prompts customers with rogue pop-ups to grant it large permissions solely to steal delicate info. The place it stands aside is the exploitation of accessibility settings to hold out ATS assaults, which permit the operators to “auto-fill fields in reputable cell banking apps and provoke cash transfers from the compromised units to a cash mule community managed by the [threat actor].”
The modus operandi successfully obviates the necessity for enrolling a brand new system to carry out fraudulent actions, whereas additionally bypassing two-factor authentication mechanisms put in place by the banking functions.
As well as, the malware comes with all options now noticed throughout all Android banking trojans, akin to the power to carry out overlay assaults to steal login credentials and bank card info, intercept reputable banking communications despatched by way of SMS, allow keylogging, and acquire full distant management of the compromised units.
SharkBot can also be notable for the steps it takes to evade evaluation and detection, together with operating emulator checks, encrypting command-and-control communications with a distant server, and hiding the app’s icon from the house display post-installation. No samples of the malware have been detected on the official Google Play Retailer, implying that the malicious apps are put in on the customers’ units both by way of sideloading or social engineering schemes.
The invention of SharkBot within the wild reveals “how cell malwares are shortly discovering new methods to carry out fraud, attempting to bypass behavioural detection countermeasures put in place by a number of banks and monetary companies over the last years,” the researchers stated.
