New Android Banking Trojan ‘Nexus’ Promoted As MaaS

A new Android banking Trojan has been uncovered in several malicious campaigns throughout the world. Dubbed ‘Nexus’ by Cleafy security researchers, the instrument is promoted as portion of a Malware-as-a-Support (MaaS) subscription and gives attributes to complete account takeover (ATO) attacks.

“In January 2023, a new Android banking Trojan appeared on numerous hacking discussion boards underneath the title of Nexus,” wrote the corporation in an advisory revealed on Tuesday. “However, [we] traced the first Nexus infections way ahead of the general public announcement in June 2022.”

Analysing Nexus samples very last 12 months, Cleafy discovered code similarities concerning the malware and SOVA, an Android banking trojan identified in mid-2021. At the time, the group thought Nexus to be an current model of SOVA.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

“Despite the new MaaS system launched under the name Nexus, the authors might have reused some elements of SOVA internals to publish new functions (and rewrite some of the present ones),” explained Cleafy.

“Recently, the SOVA creator, who operates underneath the alias ‘sovenok,’ started sharing some insights on Nexus and its romance with SOVA, calling out an affiliate who formerly rented SOVA for thieving the total resource code of the undertaking.”

About functions facilitating ATO functions, Nexus offers overlay attacks and keylogging pursuits built to steal victims’ credentials. It can also steal SMS messages (to attain two-factor authentication codes) and information and facts from cryptocurrency wallets.

Examine far more on banking trojans below: Researchers Learn Approximately 200,000 New Mobile Banking Trojan Installers

“Nexus is also outfitted with a system for autonomous updating,” Cleafy wrote. “A focused operate asynchronously checks against its C2 server for updates when the malware is managing.”

The malware also includes a module able of encryption, probably ransomware.

“This module appears to be to be below advancement due to the existence of debugging strings and the lack of utilization references,” the company clarified.

Far more frequently, Cleafy mentioned that the absence of a virtual network computing (VNC) module (that would permit for distant access) at present restrictions the action range and capabilities of Nexus.

“However, according to the infection amount retrieved from many C2 panels, Nexus is a actual threat that is able of infecting hundreds of products about the entire world,” the security crew warned. “Because of that, we are not able to exclude that it will be ready to get the phase in the up coming several months.”