New Android Banking Trojan ‘Revive’ Targeting Users of Spanish Financial Services

A beforehand unfamiliar Android banking trojan has been uncovered in the wild, focusing on end users of the Spanish fiscal providers firm BBVA.

Reported to be in its early phases of improvement, the malware — dubbed Revive by Italian cybersecurity company Cleafy — was initially observed on June 15, 2022 and dispersed by signifies of phishing strategies.

“The name Revive has been decided on because 1 of the operation of the malware (referred to as by the [threat actors] exactly ‘revive’) is restarting in case the malware stops performing, Cleafy researchers Federico Valentini and Francesco Iubatti claimed in a Monday create-up.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Accessible for download from rogue phishing pages (“bbva.appsecureguide[.]com” or “bbva.european2fa[.]com”) as a entice to trick users into downloading the application, the malware impersonates the bank’s two-factor authentication (2FA) app and is stated to be influenced from open-resource adware known as Teardroid, with the authors tweaking the initial source code to include new features.

As opposed to other banking malware that are identified to target a extensive array of financial applications, Revive is customized for a precise target, in this case, the BBVA financial institution. That mentioned, it is no diverse from its counterparts in that it leverages Android’s accessibility products and services API to meet up with its operational objectives.

Revive is mainly engineered to harvest the bank’s login credentials through the use of lookalike pages and facilitate account takeover attacks. It also incorporates a keylogger module to capture keystrokes and the skill to intercept SMS messages gained on the contaminated gadgets, mainly just one-time passwords and 2FA codes despatched by the bank.

“When the sufferer opens the destructive app for the very first time, Revive asks to settle for two permissions associated to the SMS and phone calls,” the researchers claimed. “Soon after that, a clone webpage (of the targeted financial institution) appears to the user and if the login credentials are inserted, they are sent to the [command-and-control server] of the TAs.”

The conclusions once yet again underscore the will need to physical exercise caution when it comes to downloading applications from 3rd-party untrusted resources. The abuse of sideloading has not absent unnoticed by Google, which has carried out a new element in Android 13 that blocks these kinds of apps from employing accessibility APIs.

Identified this article interesting? Stick to THN on Fb, Twitter  and LinkedIn to study a lot more exclusive content we write-up.