Toddler Android Banking Malware Makes a Splash Again
The Toddler banking malware is not exactly brand new, but is still a relatively new arrival. It first blipped on security researchers' radars in January 2021 and has been spotted in campaigns attacking Android users in several countries in continental Europe. The malware is making headlines again, after security researchers with the PRODAFT Threat Intelligence team published a detailed report that ZDNet reported on.
Toddler has been spotted in attacks carried out against victims using as many as 60 different European banks. A summer 2021 report stated that most of the attacks were focused on users in Spain and Italy, but there were efforts to spread Toddler in other continental European countries, as well as in the UK.
The primary distribution method for the Android malware is .apk files obtained from sources other than the official Google Play store. So far, there has been no evidence of apps carrying Toddler on the official Google store. However, there have been instances of legitimate websites that have hosted Toddler, after they've been compromised by the hackers.
All instances of real mobile infections that turned out to be Toddler have all targeted the same 18 banks. Interestingly, the majority of the infections have all been focused on just 5 of those 18 financial institutions. According to the security researchers who collated the data in the report, this might be indicative of a previous phishing campaign that was conducted using SMS text messages. Spain is the biggest hotspot for attacks and a total of over 7600 Android devices have been hit by Toddler.
Toddler is about as versatile as most other popular banking malware. It has the ability to steal banking details, take screenshots, even intercept incoming multi-factor identification codes, intercept SMS messages and process incoming commands from its command and control servers.
When it comes to harvesting banking credentials, Toddler uses an overlay that mimics legitimate login screens. The malware has a built-in Android app monitor and as soon as the user launches their legitimate banking tool on their phone or tablet, the overlay fires up, ready to steal whatever is entered into it.
Another feature that makes Toddler particularly interesting are its extremely stubborn persistence mechanisms. The malware will prevent the Android device from rebooting and researchers underlined that the process involved in removing Toddler from a device requires "huge technical expertise".
