Android banking trojan spreads via fake Google Play Store page

guest · Dec 27, 2021

December 24, 2021

An Android banking trojan targeting Itaú Unibanco, a large financial services provider in Brazil with 55 million customers globally, has deployed an unusual trick to spread to devices.

The actors have set up a page that looks very close to Android's official Google Play app store to trick visitors into thinking they are installing the app from a trustworthy service.
The malware pretends to be the official banking app for Itaú Unibanco and features the same icon as the legitimate app.
Click to expand...

Hijacking the actual app
Researchers at Cyble analyzed the malware, finding that upon execution, it attempts to open the real Itaú app from the actual Play Store.

If that succeeds, it uses the actual app to perform fraudulent transactions by changing the user's input fields.
The app doesn't request any dangerous permissions during installation, thus avoiding raising suspicious or risking detection from AV tools.
Click to expand...

Use the real banking apps
If you want to enjoy the convenience of mobile e-banking, make sure to install the app from the bank's official website or the Google Play Store.

Moreover, apply updates on the app as soon as they become available and use an AV tool from a reputable vendor.
To ensure maximum account security, use a strong password and enable multi-factor authentication on the app.
Click to expand...

Cyble: Malicious App Targets Major Brazilian Bank Itaú Unibanco

Android Malware is created or used by Threat Actors (TAs) to harm users through various activities such as performing fraudulent financial transactions etc.

This report focuses on one such malicious application that TAs used to target a major banking company in Brazil known as Itaú Unibanco. The malware tries to perform fraudulent financial transactions on the legitimate Itaú Unibanco applications without the victim’s knowledge. This application has a similar icon and name that could trick users into thinking it is a legitimate app related to Itaú Unibanco.
Click to expand...

During our analysis, we observed that the TA has created a fake Google Play Store page and hosted the malware that targets Itaú Unibanco on it under the name ‘sincronizador.apk.’
Click to expand...

Log in or Sign up

Android banking trojan spreads via fake Google Play Store page

guest Guest

Log in or Sign up

Android banking trojan spreads via fake Google Play Store page

guest Guest

Useful Searches