New Medusa Android Trojan Targets Banking Users Across 7 Countries

Cybersecurity scientists have identified an up to date version of an Android banking trojan referred to as Medusa that has been utilized to focus on end users in Canada, France, Italy, Spain, Turkey, the U.K., and the U.S.

The new fraud campaigns, observed in May possibly 2024 and lively considering that July 2023, manifested via five unique botnets operated by different affiliate marketers, cybersecurity firm Cleafy stated in an evaluation printed past week.

The new Medusa samples element a “light-weight permission established and new functions, these kinds of as the ability to exhibit a entire-display screen overlay and remotely uninstall applications,” security scientists Simone Mattia and Federico Valentini stated.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

Medusa, also acknowledged as TangleBot, is a advanced Android malware first identified in July 2020 concentrating on economical entities in Turkey. It arrives with capabilities to browse SMS messages, log keystrokes, capture screenshots, record phone calls, share the gadget screen in genuine-time, and execute unauthorized fund transfers employing overlay attacks to steal banking qualifications.

In February 2022, ThreatFabric uncovered Medusa strategies leveraging very similar delivery mechanisms as that of FluBot (aka Cabassous) by masquerading the malware as seemingly harmless deal shipping and utility apps. It is really suspected that the threat actors guiding the Trojan are from Turkey.

Cleafy’s newest evaluation reveals not only improvements to the malware, but also the use of dropper applications to disseminate Medusa beneath the guise of bogus updates. Moreover, genuine services like Telegram and X are utilised as dead fall resolvers to retrieve the command-and-regulate (C2) server applied for info exfiltration.

A noteworthy modify is the reduction in the amount of permissions sought in an apparent work to decreased the probabilities of detection. That mentioned, it however requires Android’s accessibility expert services API, which will allow it to stealthily empower other permissions as essential and avoid elevating person suspicion.

Yet another modification is the potential to established a black display overlay on the victim’s system to give the effect that the system is locked or driven off and use it as a deal with to have out malicious things to do.

Medusa botnet clusters usually depend on tried-and-examined strategies these types of as phishing to spread the malware. Even so, newer waves have been noticed propagating it by way of dropper applications downloaded from untrusted sources, underscoring continued initiatives on the element of menace actors to evolve their methods.

“Minimizing the needed permissions evades detection and seems additional benign, enhancing its ability to run undetected for extended periods,” the scientists said. “Geographically, the malware is increasing into new areas, such as Italy and France, indicating a deliberate effort and hard work to diversify its target pool and broaden its attack area.”

The progress will come as Symantec exposed that fictitious Chrome browser updates for Android are becoming utilized as a entice to drop the Cerberus banking trojan. Similar campaigns distributing bogus Telegram applications by using phony websites (“telegroms[.]icu”) have noticed distributing another Android malware dubbed SpyMax.

Once mounted, the application prompts the consumer to allow the accessibility solutions, enabling it to assemble keystrokes, precise locations, and even the velocity at which the system is going. The gathered info is then compressed and exported to an encoded C2 server.

“SpyMax is a distant administration instrument (RAT) that has the functionality to assemble particular/personal data from the infected device without consent from the person and sends the exact same to a remote risk actor,” K7 Security Labs explained. “This permits the risk actors to management victims’ devices that impacts the confidentiality and integrity of the victim’s privacy and details.”

Discovered this post intriguing? Adhere to us on Twitter  and LinkedIn to read a lot more exceptional written content we article.