Mexican Hacker Spreads Android Banking Malware
A cybercriminal entity with Mexican origins has been identified as the perpetrator of a global Android mobile malware campaign aimed at financial institutions. The campaign, which took place between June 2021 and April 2023, specifically targeted Spanish and Chilean banks.
Security researcher Pol Thill has attributed the activity to an individual known as Neo_Net. The research findings were published by SentinelOne after a collaborative Malware Research Challenge with vx-underground.
Despite using relatively unsophisticated tools, Neo_Net has achieved a significant level of success by customizing their infrastructure to target specific institutions. This approach has resulted in the theft of over 350,000 EUR from victims' bank accounts and the compromise of Personally Identifiable Information (PII) belonging to thousands of individuals, according to Thill.
Prominent banks, including Santander, BBVA, CaixaBank, Deutsche Bank, Crédit Agricole, and ING, have been among the primary targets.
Neo_Net, who is associated with a Spanish-speaking individual residing in Mexico, has established themselves as an experienced cybercriminal. They engage in the sale of phishing panels and compromised victim data to third parties. Additionally, they offer a service called Ankarex, which focuses on smishing (SMS phishing) and is designed to target multiple countries worldwide.
Attack Vector Starts With Smishing
The initial phase of the attack involves SMS phishing, in which the threat actor employs various tactics to deceive recipients into clicking on fake landing pages. These pages are used to collect and extract credentials through a Telegram bot.
Thill explained that the phishing pages created by Neo_Net are meticulously designed using their panels, PRIV8, and incorporate multiple defensive measures. These measures include blocking requests from non-mobile user agents and hiding the pages from bots and network scanners. The pages closely resemble legitimate banking applications, complete with animations to create a convincing façade.
The threat actors have also been observed tricking bank customers into installing fraudulent Android apps disguised as security software. Once installed, these apps request SMS permissions to capture two-factor authentication (2FA) codes sent by the bank via SMS.
