Emergent Android banking Trojan Ginp shows app overlay attacks are still effective

guest · Nov 21, 2019

Emergent Android banking Trojan shows app overlay attacks are still effective
By taking code from another Android Trojan, Anubis, the Ginp malware has enhanced itself and has begun targeting banks
November 21, 2019
https://www.csoonline.com/article/3...-app-overlay-attacks-are-still-effective.html

Researchers are tracking an Android Trojan that’s been rapidly improving over the past several months. It uses overlay attacks to steal login credentials and payment card details from users of banking and other applications.

Dubbed Ginp, the Trojan was first spotted in October 2019, but has been in the wild since at least June, according to researchers from Dutch cybersecurity company ThreatFabric.
Ginp a developing threat
Ginp started out as a new Trojan built from scratch that masqueraded as an app called Google Play Verificator. It stole incoming and outgoing SMS messages from devices. A later version, released in August added overlay attacks, which involves the display of windows on top of other applications when they’re opened.

“Although the actual targets are Spanish banking applications, looking at the path used in the inject requests, it is noticeable that the path of the overlays includes the country code of the target institution,” the ThreatFabric researchers said in a report published today.
Click to expand...

ThreatFabric: Ginp - A malware patchwork borrowing from Anubis

How it works
When the malware is first started on the device it will begin by removing its icon from the app drawer, hiding from the end user. In the second step it asks the victim for the Accessibility Service privilege as visible in following screenshot: [...]

Once the user grants the requested Accessibility Service privilege, Ginp starts by granting itself additional permissions, such as (dynamic) permissions required in order to be able to send messages and make calls, without requiring any further action from the victim.
Overlay attack
Ginp uses the Accessibility Service to check which application runs is the foreground. If the package name of the foreground app is included in the target list, an overlay is shown. The WebView-based overlay is loading an HTML page provided by the C2 in response to the package name provided by the bot.
Click to expand...

guest · Feb 17, 2020

Beware! This malware sends fake SMS links of your banking app to steal details
February 17, 2020
https://www.livemint.com/technology...king-app-to-steal-details-11581942812912.html

Researchers at cybersecurity firm Kaspersky have identified a new version of the Ginp banking Trojan that can insert fake text messages into the Inbox of a regular SMS app in a bid to obtain banking credentials of unsuspecting users.

The malware urges victims to open their banking apps with SMS and push notifications, then overlays these apps and steals banking credentials.
These messages appear under the guise of reputable vendors informing users about an undesired event like blocked account access.

To prevent this, the user is requested to open the application. Once victims do that, the Trojan overlays the original window and asks them to input the credentials for a credit card or a bank account. As a result, their payment details are handed over to cybercriminals.

"Ginp is simple, but efficient - and effective. And the rate at which it evolves and acquires new capabilities is concerning. While this attack has so far only been seen in Spain [...] could begin to emerge in other countries as well; [...]"
Click to expand...

Kaspersky: Ginp mobile Trojan fakes incoming SMS messages

In the hunt for your bank card info, the malware overlays apps with phishing pages and uses fake notifications to get you to open the apps.
Click to expand...

guest · Jun 18, 2020

Ginp Malware Operations are on the Rise, Aiming to Expand in Turkey
June 18, 2020
https://securityintelligence.com/posts/ginp-malware-operations-rising-expansions-turkey/

The Ginp mobile banking malware, which emerged in late 2019, is one of the top most prevalent Android banking malware families today. It started as a simple short message server (SMS) stealer and rapidly evolved into one of the most advanced actors in the financial fraud landscape.

Ginp has primarily targeted Spanish banks, but recent evidence suggests the malware has changed or may change its targeting strategy in the near future to focus on Turkey.
The following chart shows infection rates for different Android malware families from the last 90 days and demonstrates that Ginp accounts for nearly 12% of infections during this time.
Ginp Expands Targeting to Turkey
A few weeks ago, IBM’s Trusteer team found evidence that Ginp malware developers intend to broaden their target set to customers of Turkish banks, after targeting Spanish banking customers and customers in Poland and the United Kingdom.
Click to expand...

Specifically, our team discovered new Ginp overlay pages intended for overlay attacks on mobile devices residing on the malware’s command-and-control (C&C) servers (see Figure 2). These overlay pages are spoofs of legitimate banking pages, meant to deceive mobile device users into sharing confidential banking and other information.
Click to expand...

Evolving New Features
The Ginp malware continues to evolve rapidly, with developers frequently releasing new features. Several of these features are worth mentioning. [...]
Click to expand...

Log in or Sign up

Emergent Android banking Trojan Ginp shows app overlay attacks are still effective

guest Guest

guest Guest

guest Guest

Log in or Sign up

Emergent Android banking Trojan Ginp shows app overlay attacks are still effective

guest Guest

guest Guest

guest Guest

Useful Searches