MalRhino Android Banking Trojan Active in Latin America
The MalRhino Android Banking Trojan is a project, which shares some similarities with PixStealer. However, it goes after a broader range of targets, and packs a larger number of features. While both threats are focused on money-theft, MalRhino is certainly the more functional and feature-rich variant. However, this also makes it more susceptible to being easily caught by anti-malware services.
One of the versions of the MalRhino Android Banking Trojan goes after the Brazilian Inter Bank. It impersonates a legitimate app that this bank's customers use, iToken. The fake version was hosted on the Google Play Store, as well as on other app stores. Users were typically brought to its download page through phishing, fake ads, and other dubious strategies. Once installed, the bogus iToken app prompts its potential victim to grant it access to the Accessibility Services of Android.
MalRhino Attackers Go After Customers of Six Banks
Unlike PixStealer's offline mode, the MalRhino Android Banking Trojan communicates with a remote control server. Upon launch, it sends information about the victim's device and then scans for data related to several bank apps popular in Brazil:
- Interbank
- Nubank
- Next
- Santander
- Banco Original
- UOL PagBank
The MalRhino implant continues to work in the background and wait for the victim to load one of the supported bank apps. When this happens, the Trojan executes an overlay attack, which can be fine-tuned by the attackers. This enables them to perform fraudulent transfers with the victim's assistance, or to request all sorts of information such as logins, 2FA, PINs, and more.
The same gang is likely to be behind PixStealer and the MalRhino Trojan. So far, their activities are limited to Brazil, but they might target other parts of Latin America in the near future. Typically, these Latin American banking Trojans rarely leave the region, but there is always a chance that this might happen. Android users can protect their devices from these banking malware families by using top-of-the-shelf Android antivirus apps.
