A new banking Trojan has been pretending to be legitimate apps, like digital ID apps or news readers, in order to trick victims into downloading it so that it can take over their devices and steal the logins for their financial accounts. According to researchers at Cyfirma, these Trojan-filled malicious apps are specifically targeting Android users who have banking and cryptocurrency apps installed.
The malware is not only capable of stealing sensitive financial data off infected devices, but it also works quietly in the background like an infostealer, so it can avoid detection and continue to steal data from victims after the initial heist. Once it’s enabled on one of the best Android phones, it can also take over a device and read whatever is on the screen, tap buttons and even fill in forms. Likewise, it uses fake login screens to perform overlay attacks on top of real banking and cryptocurrency apps in order to steal any usernames and passwords that are entered by the victim.
