BeatBanker and BTMOB trojans: infection techniques and how to stay safe | Kaspersky official blog
Source Kaspersky Security Blog
Description
How to protect yourself from the BeatBanker Android trojan, which steals cryptocurrency, hijacks your hardware for crypto mining, and swipes all your data.
Impact
The BeatBanker trojan poses significant risks to affected users and organizations, especially those with employees or customers in Brazil. Its ability to stealthily mine cryptocurrency can degrade device performance and battery life, increasing operational costs and user dissatisfaction. More critically, its espionage and theft capabilities threaten the confidentiality and integrity of sensitive financial data, particularly cryptocurrency wallets and banking apps. By overlaying fake transaction screens and intercepting two-factor authentication codes, attackers can steal funds directly, causing financial losses. The malware’s remote control features enable broad surveillance, including audio recording, screen streaming, and location tracking, which can lead to privacy breaches and corporate espionage. The BTMOB module’s ability to capture PINs, passwords, and camera feeds further escalates the threat, potentially compromising personal and corporate security. Organizations with BYOD policies or mobile workforce in affected regions face increased risk of data leakage and fraud. The use of legitimate services like Firebase Cloud Messaging for command and control complicates detection and mitigation efforts. Although currently focused on Brazil, the malware’s modular design and distribution methods suggest potential for global expansion, threatening Android users worldwide. The medium severity rating reflects the malware’s sophisticated capabilities balanced against the need for user interaction and permission granting for full infection.
Defensive guidance
To mitigate the threat posed by BeatBanker, organizations and users should implement a multi-layered defense strategy tailored to the malware’s sophisticated techniques: 1. Enforce strict app installation policies restricting installations to official app stores (Google Play or vendor-preinstalled stores) and block installations from unknown sources at the device management level. 2. Educate users to recognize phishing sites and avoid downloading apps via browser links; instead, search directly within official app stores. 3. Implement mobile device management (MDM) solutions to monitor and control app permissions, especially for high-risk permissions like Accessibility Services, Install Unknown Apps, and Display Over Other Apps. 4. Deploy advanced mobile security solutions capable of detecting behavior-based anomalies and memory-resident malware modules; ensure these solutions are regularly updated. 5. Monitor network traffic for unusual connections to Firebase Cloud Messaging endpoints or suspicious command and control patterns. 6. Regularly audit installed apps and permissions on corporate and BYOD devices, removing suspicious or unnecessary apps promptly. 7. Encourage users to enable device encryption and strong authentication methods to limit unauthorized access. 8. Maintain up-to-date Android OS versions to benefit from security patches and enhanced permission controls, especially on Android 13–15 where BTMOB exploits automatic permission acquisition. 9. For organizations, consider restricting or monitoring use of cryptocurrency wallets on corporate devices and educate users on risks of overlay attacks. 10. Establish incident response plans for mobile malware infections, including forensic analysis and device isolation procedures. These targeted measures go beyond generic advice by addressing the malware’s specific infection vectors, persistence mechanisms, and control channels.
Summary
BeatBanker is an advanced Android malware campaign discovered by Kaspersky researchers, primarily targeting Brazilian users but with potential for international spread. The trojan is distributed through phishing websites that convincingly imitate the Google Play Store and popular apps such as the Brazilian government’s INSS Reembolso and the Starlink app. The infection process is multi-staged: initially, a decoy app is installed that mimics Google Play’s interface and requests permissions incrementally to avoid raising suspicion. Once granted permission to install unknown apps, the trojan downloads additional encrypted malicious modules directly into RAM, avoiding file system detection and complicating analysis. It performs environment checks to evade emulators and analysis sandboxes. To maintain persistence and avoid battery optimization shutdowns, BeatBanker plays an almost inaudible audio stream, exploiting Android’s power management policies that spare audio-playing apps. The malware includes a Monero cryptocurrency miner controlled remotely via Google’s Firebase Cloud Messaging (FCM), allowing attackers to throttle mining activity based on device temperature, battery level, and user activity. Beyond mining, BeatBanker installs spyware modules that request Accessibility Services permission to monitor user activity, overlay fake screens on top of legitimate crypto wallet apps like Binance and Trust Wallet, and redirect cryptocurrency transfers to attacker-controlled wallets. It can intercept one-time passwords from Google Authenticator, record audio, stream the screen, monitor clipboard and keystrokes, send SMS messages, and simulate user interactions. The BTMOB remote access trojan module further extends capabilities to automatic permission acquisition on Android 13–15, continuous geolocation tracking, camera access, PIN and password theft, and keylogging. The malware’s use of legitimate services like FCM for command and control, combined with its sophisticated evasion and persistence techniques, makes it difficult to detect and remove. Kaspersky products detect and block BeatBanker with specific heuristics. Users are advised to avoid downloading apps from unofficial sources, carefully review app permissions, and maintain updated security software and OS versions.
References
Community reviews
Related threats
- ZDI-26-827: (0Day) (Pwn2Own) Alpine iLX-F511 Android Auto Connection Handler Stack-based Buffer Overflow Remote Code Execution VulnerabilityMediumVulnerability
- ZDI-26-828: (0Day) (Pwn2Own) Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution VulnerabilityHighVulnerability
- Sleipnir Mobile for Android vulnerable to user interface misrepresentation of critical informationCriticalVulnerability
- Multiple Lenovo Tablets shipped with a known private test key for Android Verified BootHighVulnerability
- YuanKong RAT: the Android remote-control service that stamps its operators' names into every buildMalware