GodFather Android malware targets 400 banks, crypto exchanges

guest · Dec 30, 2022

By Bill Toulas @billtoulas - December 21, 2022

An Android banking malware named 'Godfather' has been targeting users in 16 countries, attempting to steal account credentials for over 400 online banking sites and cryptocurrency exchanges.
Click to expand...

The malware generates login screens overlaid on top of the banking and crypto exchange apps' login forms when victims attempt to log in to the site, tricking the user into entering their credentials on well-crafted HTML phishing pages.

The Godfather trojan was discovered by Group-IB analysts, who believe it is the successor of Anubis, a once widely-used banking trojan that gradually fell out of use due to its inability to bypass newer Android defenses.
Click to expand...

ThreatFabric first discovered Godfather in March 2021, but it has undergone massive code upgrades and improvements since then.

Also, Cyble published a report yesterday highlighting a rise in the activity of Godfather, pushing an app that mimics a popular music tool in Turkey, downloaded 10 million times via Google Play.
Click to expand...

Targeting banks worldwide
Group-IB has found a limited distribution of the malware in apps on the Google Play Store; however, the main distribution channels haven't been discovered, so the initial infection method is largely unknown.

Overall, Godfather is a feature-rich, dangerous trojan built on proven code from the Anubis malware, targeting an extensive list of apps and Android users from around the globe.
Click to expand...

Update 12/23/22 - A Google spokesperson has sent BleepingComputer the following statement:

Google Play Protect checks Android devices with Google Play Services for potentially harmful apps from other sources. Users are protected by Google Play Protect, which blocks these identified malicious apps on Android devices.
Google also confirmed that all the malicious apps identified in the report are no longer on Google Play.
Click to expand...

Cyble: GodFather Malware Returns Targeting Banking Users

December 20, 2022
GodFather is a notorious Android banking trojan known for targeting banking users, mostly in European countries. Cyble Research & Intelligence Labs (CRIL) blogged about this GodFather android malware in March 2022 and explained how it targeted android banking users worldwide. Recently, CRIL identified several GodFather Android samples masquerading as MYT application. This application has the name MYT Müzik which is written in the Turkish language. Thus, we suspect this application targets Android users in Turkey.
Click to expand...

Log in or Sign up

GodFather Android malware targets 400 banks, crypto exchanges

guest Guest

Log in or Sign up

GodFather Android malware targets 400 banks, crypto exchanges

guest Guest

Useful Searches