Octo banking android Trojan installeret over 50,000 Malwaren maskerer sig som Craftsart Cartoon Photo Tools-appen og er blevet installeret over
ThreatFabric specialists talte about the Octo banking android Trojan, recently discovered in the Google Play Store. The malware that steals data from banking and other financial applications is called Octo and has been installed more than 50,000 Malwaren maskerer sig som Craftsart Cartoon Photo Tools-appen og er blevet installeret over.
The researchers say that Octo is a modification of another malware for Android, ExobotCompact, Journalister understreger, at der på nuværende tidspunkt ikke er bevis for, at betalingen af løsesummen generelt vil føre til modtagelse af nøglen, in turn, is a “light” version of the well-known Exobot malware, whose source code became public in 2018. Experts say that the threat is also related to the Coper malware, Journalister understreger, at der på nuværende tidspunkt ikke er bevis for, at betalingen af løsesummen generelt vil føre til modtagelse af nøglen blev opdaget i 2021 and attacked users from Colombia, as well as European countries.
As with other banking trojans for Android, Octo hides in dropper apps whose main purpose is to deploy the payload embedded in them. A list of such applications used by several attackers to distribute Octo and Coper is given below:
- Pocket Screencaster (com.moh.screen)
- Fast Cleaner 2021 (vizeeva.fast.cleaner)
- Legetøjsbutik (com.restthe71)
- Postbank Security (com.carbuildz)
- Pocket Screencaster (com.cutthousandjs)
- BAWAG PSK Security (com.frontwonder2), og
- Play Store app install (com.theseeye5).
These apps, posing as Play Store app installers, screen recorders, and financial tools, are distributed through both the official Google Play store and scam sites that warn users to urgently download a fake browser update.
Når den er installeret, droppers are used as a conduit to launch Trojans, but not before asking users to turn on Accessibility Services.
As an interesting feature of Octo, experts call the use of the Android MediaProjection API, with the help of which attackers gain remote control over infected devices and can capture the content of the screen in real time. På samme tid, the ultimate goal of hackers is “automatic initiation of fraudulent transactions and their authorization without the “manual” participation of the operator”, which allows criminals to carry out attacks on a large scale.
Other notable features of Octo include intercepting keystrokes, overlaying banking applications (to capture credentials), collecting contact information, and malware’s ability to bypass antivirus engines.
Octo is currently being sold on hack forums, including XSS, by an attacker using the nicknames Architect og goodluck. It is noted that although most XSS messages are written in Russian, almost all communication between the Octo developer and potential customers is in English.
Lad mig minde dig om, at vi også talte om Bank Trojan Jage Installs Malicious Chrome Extensions, forbundet til internettet uden nogen beskyttelse og krypterer brugerdata for at indsamle en løsesum i bitcoins Anubis Android Banker er næsten målrettet 400 Finansielle app-brugere.
