FakeChat Malware Steals Financial Data from Android Devices

The FakeChat Malware is a dangerous banking Trojan seeking to compromise Android mobile devices. The malware was initially spread throughout Spain, but recent attack campaigns have reached other European countries like Germany, Poland, and Hungary. In March 2021, Spanish hackers involved in the FakeChat Malware were captured by law enforcement, but this does not seem to have put an end to the attacks – instead, FakeChat Malware's operation started to expand.

This banking Trojan has a rich number of features, which allow it to exploit a wide range of mobile apps used to manage finances or to make payments and online purchases. The end goal of the criminals is to obtain the bank logins, credit card details, and other payment-related data their victims use. Just like other banking Trojans of this sort, this one is also able to intercept SMS messages, therefore enabling the operators to bypass SMS-based two-factor authentication protection.

FakeChat Malware Targets Spanish Users through Fake Emails and Posts

The Spain-oriented campaign of the FakeChat Malware focused on promoting the threat through the use of fake messages, social media posts, and pop-ups. Users were told to download a fake application, which posed as a legitimate software related to Correos (Spanish postal service,) DHL, or FedEx. One of the campaigns also tried to disguise FakeChat Malware as an important software package called 'Android Update.' Users who launch the malicious APK file on their device are usually asked to grant the app 'accessibility privileges' – a trick that high-profile Android malware families use to bypass the need for other permissions.

The FakeChat Malware then sets itself as the default text message app, therefore allowing the attackers to hijack incoming SMS messages, as well as to hide them from the user. The criminals also continuously monitor the user's activity and wait for them to open an app or website that the malware is designed to attack. The 'attack' is executed through a login overlay, which is shown on top of the legitimate app or site. The change is seamless, and the design is identical to the original one, so users are unlikely to notice anything strange. Once the data is submitted, the user sees a random error, and their information is silently transmitted to the attacker's server.

FakeChat Malware's Features are Developed Continuously

On top of this, the FakeChat Malware operators have access to the following commands:

• Steal contacts.
• Send SMS Messages.
• Open URLs.
• Manage running and installed apps.
• Turn the device into a proxy.
• Hide notifications.

The criminals also introduced a major update, which appears to contain a keylogger module for the FakeChat Malware. This is a clear sign that their operation is not slowing down and, instead, they are working on developing the malware family even further.

We use our mobile devices to store and transmit all sorts of sensitive information, and it is irresponsible not to keep them as secure as possible. Threats like the FakeChat Malware may attack from anywhere, and you cannot rely on Google's default security features to keep you safe. Android users should keep their phones and tablets safe with the use of 3rd-party, reputable antivirus apps.