Alien Android banking Trojan, the powerful successor of the Cerberus malware

guest · Sep 24, 2020

Alien Android banking Trojan, the powerful successor of the Cerberus malware
September 24, 2020
https://securityaffairs.co/wordpress/108706/malware/alien-bankingtrojan.html

Researchers from ThreatFabric have discovered and analyzed a new strain of Android malware, tracked as Alien, that implements multiple features allowing it to steal credentials from 226 applications.

Alien first appeared in the threat landscape early this year, its model of sale is Malware-as-a-Service (MaaS) and is advertised on several underground hacking forums.
According to researchers, Alien borrows portions of the source code from the Cerberus malware.

Alien is considered a next-generation banking trojan that also implements remote-access features into their codebases.
Click to expand...

Experts discovered that Alien is able to show fake login pages for 226 other Android applications that allow its operators to intercept credentials.

“In the case of Alien, advanced features such as the authenticator-code stealer and notifications-sniffer aside, the features of the Trojan are quite common. As for many Trojans, the target list can be extended dynamically by the renter and applied to all bots enrolled to the botnet. [...]

“Although it is hard to predict the next steps of the Alien authors, it would be logical for them to improve the RAT, which is currently based on TeamViewer (and therefore visible when installed and executed on the device).”
Click to expand...

ThreatFabric: Alien - the story of Cerberus' demise

guest · Sep 24, 2020

Coinbase wallet users targeted by new Android malware
September 24, 2020
https://cointelegraph.com/news/coinbase-wallet-users-targeted-by-new-android-malware

A newly discovered trojan, known as Alien, is attacking crypto apps on Android phones, including Coinbase, Blockchain.com, and Luno. This new malware strain is based on the notorious Cerberus trojan, which wreaked havoc in the Google Play store until the team responsible became complacent. Lack of continued distribution allowed Google Play Protect to almost completely eradicate Cerberus by August 2020.

“Most importantly, it offers a notifications sniffer, allowing it to get the content of all notifications on the infected device, and a RAT (Remote Access Trojan) feature (by abusing the TeamViewer application), meaning that the threat actors can perform the fraud from the victim’s device.”
The choice of Coinbase and Blockchain.com is understandable as these are two of the most popular crypto apps.
Click to expand...

Log in or Sign up

Alien Android banking Trojan, the powerful successor of the Cerberus malware

guest Guest

guest Guest

Log in or Sign up

Alien Android banking Trojan, the powerful successor of the Cerberus malware

guest Guest

guest Guest

Useful Searches