Octo banking Android Trojan telepítve 50,000 alkalommal

ThreatFabric specialists spoke about the Octo banking android Trojan, recently discovered in the Google Play Store. The malware that steals data from banking and other financial applications is called Octo and has been installed more than 50,000 alkalommal.

The researchers say that Octo is a modification of another malware for Android, ExobotCompact, which, in turn, is alightversion of the well-known Exobot rosszindulatú, whose source code became public in 2018. Experts say that the threat is also related to the Coper rosszindulatú, which was discovered in 2021 and attacked users from Colombia, as well as European countries.

As with other banking trojans for Android, Octo hides in dropper apps whose main purpose is to deploy the payload embedded in them. A list of such applications used by several attackers to distribute Octo and Coper is given below:

  1. Pocket Screencaster (com.moh.screen)
  2. Fast Cleaner 2021 (vizeeva.fast.cleaner)
  3. Play Store (com.restthe71)
  4. Postbank Security (com.carbuildz)
  5. Pocket Screencaster (com.cutthousandjs)
  6. BAWAG PSK Security (com.frontwonder2), és
  7. Play Store app install (com.theseeye5).

These apps, posing as Play Store app installers, screen recorders, and financial tools, are distributed through both the official Google Play store and scam sites that warn users to urgently download a fake browser update.

Banking android trojan Octo

Once installed, droppers are used as a conduit to launch Trojans, but not before asking users to turn on Accessibility Services.

As an interesting feature of Octo, experts call the use of the Android MediaProjection API, with the help of which attackers gain remote control over infected devices and can capture the content of the screen in real time. At the same time, the ultimate goal of hackers is “automatic initiation of fraudulent transactions and their authorization without the “manual” participation of the operator”, which allows criminals to carry out attacks on a large scale.

Banking android trojan Octo

Other notable features of Octo include intercepting keystrokes, overlaying banking applications (to capture credentials), collecting contact information, and malware’s ability to bypass antivirus engines.

The rebranding of Octo permanently erases the old links with the leaked Exobot source code, attracting a lot of new attackers who are looking for an opportunity to rent a supposedly new and original Trojan. Octo’s capabilities are dangerous not only for those applications that are targeted by overlay attacks, but for any other applications installed on the infected device. The fact is that ExobotCompact/Octo can read the contents of any application displayed on the screen, as well as provide an attacker with sufficient information to remotely interact with it and carry out on-device attacks.ThreatFabric experts say.

Octo is currently being sold on hack forums, including XSS, by an attacker using the nicknames Architect és goodluck. It is noted that although most XSS messages are written in Russian, almost all communication between the Octo developer and potential customers is in English.

Due to the malware’s strong resemblance to ExoCompact, ThreatFabric assumes that Architect is the original author or the new owner of the ExoCompact source code.

Let me remind you that we also talked about Banking Trojan Chaes Installs Malicious Chrome Extensions, és azt is Anubis Android Banker Targets Nearly 400 Pénzügyi alkalmazás felhasználói.

Helga Smith

Mindig is érdekelt az informatika, különösen az adatbiztonság és a téma, amelyet manapság úgy hívnak "adattudomány", tizenéves kora óta. Mielőtt a Víruseltávolító csapathoz került volna főszerkesztőként, Több cégnél dolgoztam kiberbiztonsági szakértőként, köztük az Amazon egyik vállalkozója. Újabb élmény: Arden és Reading egyetemeken tanítok.

Válaszolj

Ez az oldal az Akismetet használja a spamek csökkentésére. Ismerje meg, hogyan dolgozzák fel megjegyzései adatait.

'Fel a tetejéhez' gomb