تستهدف البرامج الضارة MasterFred الجديدة Netflix, مستخدمو Instagram و Twitter

A new malware for Android, MasterFred, uses phishing overlays that simulate logins to steal bank card information from Netflix, مستخدمو Instagram و Twitter.

The first MasterFred sample was uploaded to فيروس توتال in June 2021, according to Bleeping Computer. أيضًا, malware analyst Alberto Segura shared a second sample of malware a week ago, saying that it was used against users from Poland and Turkey.

Currently, experts from Avast Threat Labs have studied the new malware, discovering that the banker is abusing the Accessibility service APIs to display malicious overlays and tricking victims into entering their bank card details.

While abuse of the Accessibility service is a common behavior for Android malware, MasterFred has a number of distinctive features. على سبيل المثال, malicious applications used to deliver malware to devices include HTML overlays used to display fake login forms and collect financial information about victims.

By utilizing the Application Accessibility toolkit installed on Android by default, the attacker is able to use the application to implement the Overlay attack to trick the user into entering credit card information for fake account breaches on both Netflix و تويتر. Some important things of note to this malware are that the Assets folder within the application is where the html overlays for common applications are stored along with fake bank login overlays in multiple languages.according to Avast Threat Labs.

فضلاً عن ذلك, the malware uses the Onion.ws gateway (also known as the Tor2Web proxy) to deliver stolen information to Tor servers controlled by hackers.

Since at least one of the malicious apps with MasterFred on board was available in the جوجل متجر اللعب (it has now been removed), the researchers are confident that the banker is spreading through third-party app stores.

Indicators of compromise for MasterFred, including hashes and C&C server domains, have already been posted on Twitter by Avast Threat Labs.

Avast Threat Labs

Let me remind you that I also wrote that BloodyStealer malware hijacks Steam, Epic Games Store and EA Origin accounts.

هيلجا سميث

كنت دائمًا مهتمًا بعلوم الكمبيوتر, خاصة أمن البيانات والموضوع, وهو ما يسمى في الوقت الحاضر "علم البيانات", منذ سنوات مراهقتي المبكرة. قبل الانضمام إلى فريق Virus Removal كرئيس تحرير, عملت كخبير في الأمن السيبراني في العديد من الشركات, بما في ذلك أحد مقاولي أمازون. تجربة أخرى: لقد حصلت على التدريس في جامعات أردن وريدينج.

اترك رد

هذا الموقع يستخدم Akismet للحدّ من التعليقات المزعجة والغير مرغوبة. تعرّف على كيفية معالجة بيانات تعليقك.

زر الذهاب إلى الأعلى