Marcher banking trojan campaign attacks Austrians' finances three different ways

itman · Nov 7, 2017

An attack campaign targeting Android users in Austria has been employing a unique trio of techniques to steal their funds: a credentials phishing web page, malicious banking app overlays, and credit card phishing screens.

The latter two techniques come courtesy of the Marcher banking trojan, which, according to a Proofpoint blog post published last Friday, is being used in increasingly sophisticated campaigns, "with multiple attack vectors and various targeted financial services and communication platforms."

Proofpoint notes that the three-in-one Marcher campaign has been active since at least January 2017, setting its sights on customers of large Austrian financial institutions such as Bank Austria, Raiffeisen Meine Bank, and Sparkasse.
Click to expand...

https://www.scmagazine.com/marcher-...finances-three-different-ways/article/705712/

stapp · Jan 18, 2018

Exobot (Marcher)Author Calls It Quits and Sells Off Banking Trojan Source Code

Things are about to get a lot worse for Android users after the source code of a highly advanced Android banking trojan has been sold to different parties on a well-known hacking forum.
Click to expand...

https://www.bleepingcomputer.com/ne...its-and-sells-off-banking-trojan-source-code/

Minimalist · Jul 23, 2018

Source Code for Exobot Android Banking Trojan Leaked Online

The source code of a top-of-the-line Android banking trojan has been leaked online and has since rapidly spread in the malware community, worrying researchers that a new wave of malware campaigns may be in the works.
Click to expand...

https://www.bleepingcomputer.com/ne...-exobot-android-banking-trojan-leaked-online/

guest · Sep 10, 2018

IBM X-Force Delves Into ExoBot’s Leaked Source Code
September 10, 2018
https://securityintelligence.com/ibm-x-force-delves-into-exobots-leaked-source-code/

Following the recent source code leak of the Android banking Trojan ExoBot, IBM X-Force research delved into the malware’s inner workings to help uncover insights into its dynamic mechanisms and the features that help criminals use it in cross-channel bank fraud.

ExoBot is Android malware that was based originally on a previous code known as Marcher. This code represents a banking Trojan that uses the overlay technique — that is, popping up fake windows that hide the original app users open — to trick victims into tapping their banking credentials into a fake interface.

Some of the capabilities that enable ExoBot to facilitate fraudulent activity on infected devices include gaining admin privileges, launching overlay screens, and exfiltrating SMS, data and other information from the infected device.

The following sections describe technical details about ExoBot as analyzed by X-Force mobile threat researcher Shahar Tavor. [...]
Click to expand...

Log in or Sign up

Marcher banking trojan campaign attacks Austrians' finances three different ways

itman Registered Member

stapp Global Moderator

Minimalist Registered Member

guest Guest

Log in or Sign up

Marcher banking trojan campaign attacks Austrians' finances three different ways

itman Registered Member

stapp Global Moderator

Minimalist Registered Member

guest Guest

Useful Searches