Malicious Android Apps Clone Real Services and Apps to Steal Banking Info
The start of 2022 has been rife with news about mobile malware. In yet another case of security researchers intercepting Android-based malware, a team with ESET detected a campaign that was spoofing legitimate apps on the Malaysian market and using them to steal victims' banking information.
At least three separate apps were involved in the campaign, according to researchers. The fake Android apps were spoofing different services and legitimate apps associated with them that are popular inside the Asian country.
Maid services among most spoofed apps
The campaign was attempting to steal victim banking credentials with eight different banks targeted. It seems house maid services are a very hot topic in Malaysia, as the majority of the apps spoofed were ones offering house cleaning and maid services. Names included Grabmaid, Maid4u, and Maideasy. A pet shop service was also spoofed by the malicious apps.
While the majority of apps that were cloned and loaded with malware do exist as legitimate, separate versions on the Google Play Store, some of the services whose names the hackers abused don't even have a mobile app on Google Play.
The gist of the attack consists of the victim downloading the fake app and trying to make a purchase for a product or a service inside it. Of course, there is no product being offered by the hackers and it's all a facade. Upon trying to purchase, the customer is given two options, one of which is always grayed out, leaving only bank transfer.
If a victim attempts to use bank transfer, they are shown a screen containing the logos and names of eight different Malaysian banks. Once the victim chooses a banking service, they have to enter their credentials, at which point their banking info is collected and exfiltrated to a hacker-controlled server.
Malicious apps could intercept MFA SMS
The hackers had even set up web pages to go with some of the apps, offering the same fake products and services. The web pages served as simple redirects because trying to purchase anything on them would simply send the victim to the download of the malicious fake app.
As one final trick, the hackers behind the campaign also set up the malware to intercept MFA SMS messages that banks might use as extra security and send to their customers. This doesn't mean that the malicious campaign was foolproof. The victims would still receive MFA texts out of nowhere, without taking any action, when the hackers would later attempt to withdraw or transfer money from the accounts.
