Researchers Have Their Eye on Malicious Clones of Android Apps That Put Devices at Risk

Researchers at Check Point have found malicious apps in the Google Play Store that will download Trojans to infected devices.

“Check Point Research (CPR) recently discovered a new Dropper spreading via the official Google Play store, which downloads and installs the AlienBot Banker and MRAT,” the researchers write. “This Dropper, dubbed Clast82, utilizes a series of techniques to avoid detection by Google Play Protect detection, completes the evaluation period successfully, and changes the payload dropped from a non-malicious payload to the AlienBot Banker and MRAT.”

The malicious apps posed as VPNs or audio apps. Once the malware was installed, it would gain access to the device’s banking apps.

“The AlienBot malware family is a Malware-as-a-Service (MaaS) for Android devices that allows a remote attacker, at a first step, to inject malicious code into legitimate financial applications,” Check Point says. “The attacker obtains access to victims’ accounts, and eventually completely controls their device. Upon taking control of a device, the attacker has the ability to control certain functions just as if he was holding the device physically, like installing a new application on the device, or even control it with TeamViewer.”

If the victim’s phone doesn’t allow external installations, the malware will try to trick the user into granting permission.

“If the infected device prevents installations of applications from unknown sources, Clast82 prompts the user with a fake request, pretending to be ‘Google Play Services’ requesting the user to allow the installation every 5 seconds,” Check Point says. “After the malicious payload is successfully installed, the dropper app launches the payload downloaded. In the case of Clast82, we were able to identify over 100 unique payloads of the AlienBot, an Android MaaS Banker (Malware as a service) targeting financial applications and attempting to steal the credentials and 2FA codes for those applications.”

Google has since removed the malicious apps from the Play Store. New-school security awareness training can help your employees avoid falling for phishing attacks and other social engineering tactics.

Check Point has the story.


SOURCE: KnowBe4.com

Partner, Law Firm

We hired IT360 as our computer hardware and software computer consultants when the company first went into business. Since then, they have helped us purchase new software and hardware equipment that we have instituted into the law firm. Any time we needed them to be there they have been. They have solved all of our problems including: stand alone computers, networking issues, Internet access issues, and software. I would highly recommend IT360 to anybody who needs help in these areas.

Partner, Law Firm

Recent
Technology News

IT360 News
Choosing a Cybersecurity Approach

In the first part of this series released on Tuesday, we set the stage for present-day ransomware attacks. These professional enterprises have developed (and continue to improve upon) automated technology that increases their reach and depth of attacks. Businesses can no longer take a wait-and-see approach or keep kicking the cybersecurity can down the road. […]

Read more
IT360 News
Ransomware Attacks Aren’t Just for Big Companies

While millions of Americans were celebrating a long Independence Day weekend, something sinister was happening behind the scenes. Considered to be one of the largest ransomware attacks ever, more than 1,000 businesses worldwide were suddenly locked out of their own IT systems with demands to pay up to $5 million each to regain access to […]

Read more