Malicious Apps Disguised as Banks and Government Agencies Targeting Indian Android Users

Android smartphone people in India are the goal of a new malware campaign that employs social engineering lures to put in fraudulent applications that are capable of harvesting sensitive information.

“Applying social media platforms like WhatsApp and Telegram, attackers are sending messages intended to entice users into setting up a malicious application on their cell device by impersonating reputable corporations, this sort of as banks, government services, and utilities,” Microsoft danger intelligence researchers Abhishek Pustakala, Harshita Tripathi, and Shivang Desai reported in a Monday investigation.

The final objective of the procedure is to seize banking aspects, payment card info, account credentials, and other personalized information.

The attack chains entail sharing malicious APK files through social media messages sent on WhatsApp and Telegram by falsely presenting them as banking applications and inducing a sense of urgency by declaring that the targets’ financial institution accounts will be blocked unless of course they update their long-lasting account quantity (PAN) issued by the Indian Cash flow Tax Office by the bogus application.

Upon installation, the app urges the victim to enter their financial institution account information and facts, debit card PIN, PAN card numbers, and online banking qualifications, which are subsequently transmitted to an actor-controlled command-and-management (C2) server and a hard-coded phone number.

“As soon as all the requested particulars are submitted, a suspicious note appears stating that the specifics are staying confirmed to update KYC,” the researchers mentioned.

“The consumer is instructed to wait around 30 minutes and not to delete or uninstall the app. Additionally, the application has the operation to conceal its icon, leading to it to disappear from the user’s device house display screen whilst even now functioning in the background.”

An additional noteworthy part of the malware is that it requests the person to grant it permission to examine and deliver SMS messages, therefore enabling it to intercept one particular-time passwords (OTPs) and deliver the victims’ messages to the danger actor’s phone selection through SMS.

Variants of the banking trojan found out by Microsoft have also been located to steal credit history card specifics together with individually identifiable info (PII) and incoming SMS messages, exposing unsuspecting customers to economical fraud.

Nevertheless, it truly is well worth noting that for these attacks to be effective, consumers will have to allow the possibility to install apps from mysterious sources outdoors of the Google Enjoy Retail outlet.

“Cell banking trojan infections can pose sizeable pitfalls to users’ personalized info, privacy, device integrity, and economical security,” the researchers stated. “These threats can often disguise them selves as authentic applications and deploy social engineering ways to achieve their targets and steal users’ sensitive facts and financial property.”

The progress will come as the Android ecosystem has also appear beneath attack from the SpyNote trojan, which has specific Roblox end users beneath the guise of a mod to siphon sensitive information.

In an additional instance, bogus adult web-sites are being applied as lures to entice consumers into downloading an Android malware known as Enchant that exclusively focuses on pilfering details from cryptocurrency wallets.

“Enchant malware uses the accessibility service attribute to goal particular cryptocurrency wallets, such as imToken, OKX, Bitpie Wallet, and TokenPocket wallet,” Cyble stated in a recent report.

“Its principal objective is to steal critical info such as wallet addresses, mnemonic phrases, wallet asset particulars, wallet passwords, and non-public keys from compromised equipment.”

Very last month, Doctor Web uncovered quite a few malicious applications on the Google Enjoy Shop that shown intrusive ads (HiddenAds), subscribed people to quality expert services with out their understanding or consent (Joker), and promoted investment decision frauds by masquerading as trading software package (FakeApp).

The onslaught of Android malware has prompted Google to announce new security features such as genuine-time code-degree scanning for newly encountered apps. It also introduced limited configurations with Android 13 that prohibits apps from getting access to critical gadget configurations (e.g., accessibility) until it can be explicitly enabled by the person.

It is not just Google. Samsung, in late Oct 2023, unveiled a new Car Blocker possibility that stops application installations from resources other than Google Enjoy Retail outlet and Galaxy Retail outlet, and blocks hazardous instructions and application installations as a result of the USB port.

To stay clear of downloading malicious computer software from Google Play and other reliable resources, consumers are advised to examine the legitimacy of the app builders, scrutinize testimonials, and vet the permissions asked for by the applications.

Discovered this write-up exciting? Stick to us on Twitter  and LinkedIn to browse more special content we submit.

Some pieces of this short article are sourced from:
thehackernews.com