Cybercriminals Steal Millions by Spoofing Thousands of Mobile Devices

guest · Dec 16, 2020

Cybercriminals Steal Millions by Spoofing Thousands of Mobile Devices
December 16, 2020
https://www.securityweek.com/cybercriminals-steal-millions-spoofing-thousands-mobile-devices

Targeting financial institutions in Europe and the United States, the mobile banking fraud operation relied on over 20 emulators to spoof more than 16,000 mobile devices and access compromised accounts.

Mobile device identifiers were used to spoof the devices of the account holders, but in some cases the attackers set up new identifiers, to make it seem as if the user was accessing the account from a new device. Credentials stolen from infected systems or via phishing were also used.

“Using automation, scripting, and potentially access to a mobile malware botnet or phishing logs, the attackers, who have the victim’s username and password, initiate and finalize fraudulent transactions at scale,” IBM Security Trusteer’s researchers, who discovered the operation, explain.
Click to expand...

The individuals behind this operation were likely in the possession of account holders’ usernames and passwords, had access to device identifiers and other data (likely from compromised devices), and were able to obtain SMS message content.

The attackers also created custom-tailored applications that would mimic the application they were targeting. They also kept a close eye on how the target applications reacted to the connections from their spoofed devices.

“It is likely that those behind [this operation] are an organized group with access to skilled technical developers of mobile malware and those versed in fraud and money laundering. [...]”
Click to expand...

The security researchers also discovered fraud-as-a-service offerings on underground markets promising access to similar operations for paying subscribers.
Click to expand...

IBM: IBM Trusteer Exposes Massive Fraud Operation Facilitated by Evil Mobile Emulator Farms

IBM Security Trusteer’s mobile security research team has recently discovered a major mobile banking fraud operation that managed to steal millions of dollars from financial institutions in Europe and the US within a matter of days in each attack before being intercepted and halted.

Given the size and scale of this attack, we are publishing this blog to urgently raise awareness to the sophistication of the campaign, and to help financial institutions prepare for potential similar attacks on their customer base.
Click to expand...

Log in or Sign up

Cybercriminals Steal Millions by Spoofing Thousands of Mobile Devices

guest Guest

Log in or Sign up

Cybercriminals Steal Millions by Spoofing Thousands of Mobile Devices

guest Guest

Useful Searches