มัลแวร์ MasterFred ใหม่กำหนดเป้าหมายไปที่ Netflix, ผู้ใช้ Instagram และ Twitter

A new malware for Android, มาสเตอร์เฟรด, uses phishing overlays that simulate logins to steal bank card information from Netflix, ผู้ใช้ Instagram และ Twitter.

The first มาสเตอร์เฟรด sample was uploaded to ไวรัสรวม in June 2021, according to คอมพิวเตอร์ส่งเสียงบี๊บ. อีกด้วย, malware analyst Alberto Segura shared a second sample of malware a week ago, saying that it was used against users from Poland and Turkey.

Currently, ผู้เชี่ยวชาญจาก Avast Threat Labs have studied the new malware, discovering that the banker is abusing the Accessibility service APIs to display malicious overlays and tricking victims into entering their bank card details.

While abuse of the Accessibility service is a common behavior for Android malware, MasterFred has a number of distinctive features. ตัวอย่างเช่น, malicious applications used to deliver malware to devices include HTML overlays used to display fake login forms and collect financial information about victims.

นอกจากนี้, the malware uses the Onion.ws gateway (also known as the Tor2Web proxy) to deliver stolen information to Tor servers controlled by hackers.

Since at least one of the malicious apps with MasterFred on board was available in the Google ร้านขายของเล่น (it has now been removed), the researchers are confident that the banker is spreading through third-party app stores.

Indicators of compromise for MasterFred, including hashes and C&C server domains, have already been posted on Twitter by Avast Threat Labs.

ฉันขอเตือนคุณว่าฉันเขียนแบบนั้นด้วย BloodyStealer malware hijacks Steam, Epic Games Store and EA Origin accounts.