As an overview the key points are:
- A new version of BankBot, a malicious mobile trojan, has been hiding in apps that pose as supposedly trustworthy flashlight apps, tricking users into downloading them.
- In a second campaign, the solitaire games and a cleaner app have been dropping additional kinds of malware besides BankBot, called Mazar and Red Alert.
- The dark intention of these apps has been to spy on users, collect their bank login details and steal their money.
- Google previously removed older versions of BankBot-carrying apps from the Play Store within days. However, several versions remained active until November 17th. This was long enough for the apps to infect thousands of users.
- The malicious activities include the installation of a fake user interface that’s laid over the clean banking app when it’s opened by the user.
- The research was conducted by the mobile threat intelligence team at Avast in collaboration with researchers at ESET and SfyLabs.
Nikolaos Chrysaidos, Head of Mobile Threat Intelligence & Security at Avast:
“A new version of the mobile banking Trojan BankBot slipped into Google Play in October and November, disguised as flash light, gaming and cleaning apps. The cyber criminals have been targeting customers of big banks like Wells Fargo, Chase and about 160 other banking apps in the U.S., Latin America, Europe and the Asia Pacific region. Google is often fast at removing malicious programs from Google Play, however the problem is that the apps infected with the BankBot Trojan have been able to bypass Google’s security checks in the first place. It is essential that users install a security app on their phone to protect them from BankBot and other banking Trojans. They should also be vigilant when using their banking app and look for unfamiliar modifications to the app’s interface. Adding an extra layer of security with two-factor authentication at login is also advised, and users should only rely on trusted app stores when downloading apps. Even though the malware slipped into Google Play, its second component, the malware payload, was downloaded from an external source.”
