SharkBot Android Trojan Steals Cryptocurrency and Hacks Bank Accounts

Cleafy and ThreatFabric have discovered a new Android Trojan شارک بوٹ that uses the Accessibility service to steal credentials from banking and cryptocurrency applications in Italy, the United Kingdom and the United States.

According to experts, the malware has been spreading since October 2021. The malware has not been seen in the official گوگل Play Store yet; instead, its operators seem to trick users into downloading and manually installing the application on their devices (side-loading). مثال کے طور پر, it is known that شارک بوٹ can disguise itself as a media player, streaming application, or data recovery applications.

Media Apps

After installing an application infected with SharkBot, the malware asks the user to grant it access to the Accessibility service. The malware uses the obtained rights to simulate screen touches and perform various malicious tasks, including: granting itself administrator rights, displaying fake login screens, keylogging, intercepting and hiding two-factor authentication SMS messages, as well as accessing banking and cryptocurrency applications for the purpose of transferring funds.

SharkBot is currently targeting 22 banking applications that are used in Italy and the UK, as well as five cryptocurrency related applications. At the same time, cybersecurity experts write that the malware is still in the early stages of development.

ATS

SharkBot’s primary goal is to initiate money transfers from compromised devices using Automatic Transfer Systems (ATS), bypassing multi-factor authentication mechanisms (such as SCA),” the report says. “After successfully installing SharkBot on a victim’s device, attackers can obtain confidential banking information by abusing the Accessibility service, including credentials, personal information, current balance, اور اسی طرح.

Bank App

According to experts, the use of Automatic Transfer Systems is consistent with the general trend that can be traced in the work of other banking Trojans for Android, including the Alien, ایونٹ بوٹ, میڈوسا, Gustuff, Anatsa اور فلو بوٹ malware.

Let me remind you that we also wrote that Newly discovered PhoneSpy Spyware Already Infected Over 1000 Phones, اور یہ کہ AbstractEmu Android malware “roots” smartphones and evades detection.

ہیلگا اسمتھ

مجھے ہمیشہ کمپیوٹر سائنسز میں دلچسپی تھی۔, خاص طور پر ڈیٹا سیکیورٹی اور تھیم, جسے آج کل کہا جاتا ہے۔ "ڈیٹا سائنس", میری ابتدائی نوعمری سے. ایڈیٹر ان چیف کے طور پر وائرس ہٹانے والی ٹیم میں آنے سے پہلے, میں نے کئی کمپنیوں میں سائبر سیکیورٹی کے ماہر کے طور پر کام کیا۔, ایمیزون کے ٹھیکیداروں میں سے ایک سمیت. ایک اور تجربہ: مجھے آرڈن اور ریڈنگ یونیورسٹیوں میں پڑھانا ملا ہے۔.

جواب چھوڑیں

یہ سائٹ سپیم کو کم کرنے کے لیے Akismet کا استعمال کرتی ہے۔. جانیں کہ آپ کے تبصرے کے ڈیٹا پر کیسے کارروائی کی جاتی ہے۔.

واپس اوپر کے بٹن پر