Threats tagged 'banking trojan'

Frogblight is a medium-severity Android banking Trojan primarily targeting users in Turkey. It masquerades as legitimate apps, initially as a court case file viewer and later as common apps like Chrome, to trick victims into installation. The malware steals banking credentials via official government websites and has extensive spyware capabilities, including SMS interception, app enumeration, device info collection, and sending arbitrary SMS messages. It employs advanced persistence and anti-deletion techniques and is distributed mainly through smishing campaigns exploiting legal concerns. Although currently focused on Turkey, its sophisticated remote control features and ongoing development pose risks if it spreads. No CVSS score exists, but the threat impacts confidentiality and integrity significantly with moderate ease of exploitation and no user interaction beyond initial install. European organizations with Turkish-speaking users or business ties should monitor for potential spillover. Mitigations include user education on smishing, app installation restrictions, SMS monitoring, and enhanced mobile endpoint protection.

Malware#android#smishingGermany+5

Albiriox is a newly discovered Android RAT malware offered as Malware-as-a-Service, primarily targeting financial and cryptocurrency applications globally. It uses a sophisticated two-stage deployment involving dropper apps and packing to evade detection. The malware enables remote control of infected devices via VNC-based access and overlay attacks, allowing real-time interaction and unauthorized operations such as screen manipulation and device takeover. It targets over 400 financial and crypto wallet apps, facilitating on-device fraud while remaining stealthy. The MaaS model and ongoing development indicate potential rapid spread among cybercriminals. Although no known exploits in the wild are reported yet, its advanced capabilities pose a significant threat to mobile users, especially in finance sectors. The malware is linked to Russian-speaking threat actors and uses multiple fake domains for distribution. European organizations with mobile banking and crypto wallet users are at risk, particularly in countries with high Android usage and financial sector prominence. Mitigation requires targeted detection of dropper apps, user education on app sources, and enhanced mobile endpoint protection. Given its impact on confidentiality, integrity, and availability with ease of exploitation and no user interaction needed post-installation, the threat severity is assessed as high.

Malware#android#vncGermany+9

The Water Saci campaign is a sophisticated malware operation primarily targeting Brazilian banking and cryptocurrency platforms via WhatsApp. It employs multi-format malware delivery using various scripting languages, including a shift from PowerShell to Python, likely enhanced by AI tools to evade detection and complicate analysis. The malware features aggressive anti-sandbox techniques, extensive backdoor capabilities, and persistence mechanisms. Although currently focused on Brazil, the use of WhatsApp as a propagation vector and targeting financial applications poses a potential risk to European organizations with ties to Brazilian markets or users. The campaign’s complexity and AI-enhanced development pipeline indicate a medium severity threat with significant evasion and persistence capabilities. Defenders should prioritize monitoring WhatsApp-based phishing attempts, scrutinize multi-format file attachments, and implement advanced behavioral detection to mitigate risks. Countries with strong economic or diaspora links to Brazil and high WhatsApp usage are more likely to be affected.

Malware#backdoor#pythonPortugal+6

A phishing campaign targeting Brazilian users spreads a banking trojan via WhatsApp Web by leveraging an open-source automation script. The attack starts with a malicious VBS script in a phishing email that downloads and executes an MSI installer and another VBS script. The second VBS installs Python and Selenium to inject malicious JavaScript into WhatsApp Web, enabling the malware to propagate by sending itself to the victim's contacts. The MSI drops an AutoIt script that monitors for Brazilian banking and cryptocurrency application windows and loads an encrypted payload into memory to evade detection. This payload specifically targets Brazilian financial institutions and cryptocurrency wallets. The campaign uses in-memory execution and automation to maintain stealth and persistence. No known exploits in the wild have been reported yet, and the campaign is currently assessed as medium severity. The attack is highly tailored to Brazilian users and financial targets but could pose risks if similar tactics spread elsewhere.

Malware#selenium#whatsappPortugal+5

Sturnus is a newly identified Android banking trojan targeting financial institutions in Southern and Central Europe. It features advanced capabilities such as full device takeover, harvesting banking credentials, keylogging, and remote control via VNC. Notably, it can bypass encryption on popular messaging apps like WhatsApp, Telegram, and Signal to monitor communications. The malware uses sophisticated communication protocols including WebSocket and HTTP to interact with its command-and-control servers. Although still in development and not yet exploited in the wild, Sturnus poses a significant threat to financial security and user privacy. It employs HTML overlays for data exfiltration and extensive environment monitoring to evade detection. The malware’s complexity and targeting of Android devices make it a serious concern for European financial sectors. Defenders should prioritize detection and containment measures to mitigate potential impacts.

Campaign#banking trojan#remote controlItaly+6

A malware campaign targeting WhatsApp users primarily in Brazil uses WhatsApp's 'View Once' message feature to deliver malicious ZIP archives containing VBS or HTA files. These files execute PowerShell scripts to download additional payloads, including scripts that steal WhatsApp user data and an MSI installer deploying the Astaroth banking trojan. The campaign evolved from IMAP-based to HTTP-based command and control communication and leverages Selenium Chrome WebDriver and the WPPConnect JavaScript library to hijack WhatsApp Web sessions, steal session tokens and contacts, and distribute spam. Over 250 victims have been identified, with 95% located in Brazil and some impact noted in Austria. The attack enables credential theft, session hijacking, persistence, and financial fraud through banking trojan deployment. No CVE or known exploits in the wild are reported, and the campaign is rated medium severity. Defenders should focus on user awareness, endpoint detection of PowerShell and script execution, and monitoring for suspicious WhatsApp Web activity.

Campaign#persistence#guildmaAustria+1

This intelligence report examines the connection between two Brazilian banking trojans, Maverick and Coyote. The malware spreads through WhatsApp, using a multi-stage attack that begins with a malicious LNK file. Both trojans share similarities in their infection methods, targeting Brazilian users and banks. The attack chain involves obfuscated PowerShell commands, downloading additional payloads from command and control servers. The malware employs anti-analysis techniques and targets specific browsers. Persistence is achieved through a batch file in the startup folder. The report provides technical details, including code samples and infection chain analysis, as well as indicators of compromise for the identified malware campaign.

Malware#maverick#whatsappPortugal+6

The Lampion banking trojan campaign, active since at least 2019, is a sophisticated spam operation originating from Brazil that targets users primarily through malicious email attachments and ClickFix-themed lures. The infection chain uses multiple stages of obfuscated Visual Basic scripts to deploy an updated Lampion Stealer malware. The threat actors employ advanced evasion tactics such as IP blacklisting and large file sizes to hinder analysis, and they leverage multiple cloud providers for distributed, ephemeral infrastructure. The campaign targets domains mimicking Portuguese tax authorities and finance portals, indicating a focus on Portuguese-speaking European countries. Although no CVSS score is assigned, the threat poses a medium severity risk due to its potential to steal sensitive banking credentials and personal data, combined with its persistence and stealth. European organizations, especially in Portugal, are at heightened risk given the targeted domain names and lures. Defenders should focus on enhanced email filtering, user awareness training about attachments, domain monitoring, and endpoint detection of obfuscated script execution to mitigate this threat.

Malware#lampion#clickfixPortugal

Android/BankBot-YNRK is a sophisticated mobile banking Trojan targeting Android devices, specifically aiming at financial and cryptocurrency applications. It abuses Android accessibility services to gain elevated privileges, enabling it to automate UI interactions and extract sensitive user data. The malware can masquerade as legitimate apps, suppress audio notifications to avoid user detection, and perform unauthorized operations such as credential theft and fraudulent transactions. It maintains persistence on infected devices and communicates with command-and-control (C2) servers to receive remote commands and exfiltrate data. Although no known exploits are reported in the wild, the trojan represents a significant threat to Android users, especially those engaged in mobile banking and cryptocurrency activities. The malware’s complexity and stealth capabilities increase the risk of financial loss and privacy breaches. European organizations with employees or customers using Android banking or crypto apps are at risk, particularly in countries with high Android market share and digital banking adoption. Mitigation requires targeted measures including restricting accessibility service permissions, monitoring network traffic for suspicious domains, and educating users on app installation risks.

Malware#overlay attacks#cryptocurrency theftGermany+7

GhostGrab is a sophisticated Android malware that combines cryptocurrency mining with extensive data theft, targeting sensitive financial information such as banking credentials, debit card details, and OTPs. It exploits device resources for mining while maintaining persistence through advanced hiding techniques and resisting removal. The malware abuses permissions to access SMS, calls, and storage, enabling comprehensive data exfiltration. It uses Firebase for command-and-control and data exfiltration, masking malicious activity within legitimate cloud traffic. Its modular design includes WebView-based phishing pages aimed at financial fraud and identity theft. The malware infrastructure involves recently registered domains and obfuscation services, indicating a professional operation. GhostGrab exemplifies the convergence of financial cybercrime and resource exploitation in mobile malware, posing a significant threat to Android users. European organizations with mobile banking users are at risk, especially where Android market share is high. Mitigation requires enhanced mobile security controls, user awareness, and network monitoring for suspicious Firebase traffic.

Malware#ghostgrab#cryptocurrency miningGermany+7

Herodotus is a newly discovered Android malware designed to perform device takeover by mimicking human behavior to evade biometric and automated detection. It is distributed via side-loading and targets financial organizations and cryptocurrency wallets, with active campaigns observed in Italy and Brazil and potential for global spread. The malware is offered as Malware-as-a-Service and is linked to the Brokewell malware family. It steals credentials and remotely controls infected devices, using randomized delays between inputs to simulate human interaction. This behavior mimicry complicates detection by security solutions relying on behavioral analysis. The malware’s focus on financial targets and crypto wallets poses significant risks to confidentiality and financial integrity. European organizations, especially in Italy and Poland, are currently targeted and should prepare for potential expansion. Mitigation requires advanced layered security, including strict app installation policies, behavioral anomaly detection tuned for such mimicry, and user education on side-loading risks.

Campaign#banking trojan#mqttItaly+1

The Water Saci campaign is a sophisticated malware operation targeting Portuguese-language systems, leveraging WhatsApp Web hijacking and multi-vector persistence mechanisms. It uses script-based techniques such as VBS downloaders and PowerShell scripts to automate malware distribution and maintain resilience. The campaign employs an email-based command and control infrastructure using IMAP for command retrieval, supplemented by HTTP polling for continuous communication. It features advanced anti-analysis capabilities and real-time remote control, enabling infected machines to operate as a coordinated botnet. The malware shares similarities with the Coyote banking trojan, indicating ties to Brazilian cybercriminal groups. Although no known exploits are reported in the wild, the campaign's complexity and persistence mechanisms pose a medium-level threat. European organizations with Portuguese-speaking user bases or connections to Brazil should be particularly vigilant. Mitigation requires targeted detection of script-based loaders, monitoring of WhatsApp Web session anomalies, and securing email clients against unauthorized IMAP access. Countries with strong economic or cultural ties to Brazil, such as Portugal and Spain, are most likely to be affected.

Malware#sorvepotel#banking trojanPortugal+4

Maverick is a banking Trojan targeting Brazilian users via a large-scale WhatsApp distribution campaign. It starts with a malicious LNK file sent through WhatsApp, leading to a fileless infection chain. The malware uses the WPPConnect project to automate spreading through hijacked WhatsApp accounts. It monitors multiple Brazilian banks, cryptocurrency exchanges, and a payment platform to steal banking credentials. Maverick employs advanced evasion techniques including AI-assisted code development and shares traits with the Coyote banking Trojan. The campaign is notable for its worm-like propagation and exploitation of a widely used messaging platform.

Malware#fileless#maverickBrazil

A new Astaroth banking trojan campaign has been discovered abusing GitHub to host malware configurations. The infection begins with a phishing email containing a link to download a zipped Windows shortcut file, which installs the Astaroth malware. The trojan detects when users access banking or cryptocurrency websites and steals credentials through keylogging. It sends stolen information to attackers using Ngrok reverse proxy and uses GitHub to update its configuration when command and control servers become inaccessible. The malware primarily targets South American countries, with a focus on Brazil. Astaroth employs various anti-analysis techniques and targets specific banking and cryptocurrency-related sites. The GitHub repositories hosting the malicious configurations have been reported and taken down.

Malware#guildma#github abusePortugal+6

A new Android banking trojan named RatOn has emerged, combining NFC relay attacks with remote access and automated transfer capabilities. Discovered by analysts monitoring the NFSkate threat group, RatOn targets cryptocurrency wallets and banking applications, particularly in the Czech Republic and Slovakia. The malware is distributed through adult-themed websites and employs a multi-stage infection process. RatOn features overlay attacks, automated money transfers, and cryptocurrency wallet takeovers. It demonstrates sophisticated capabilities, including screen casting, PIN interception, and extensive bot commands. The trojan's evolution from a basic NFC relay tool to a complex RAT with ATS functionality makes it a significant threat in the mobile malware landscape.

Campaign#cryptocurrency#nfskateSlovakia+1

A sophisticated mobile malware campaign is targeting Indonesian pensioners by impersonating TASPEN, the state pension fund. The attackers use a phishing website to distribute a malicious Android app that steals banking credentials, intercepts SMS messages for OTPs, and captures biometric data. The malware employs advanced evasion techniques and communicates with a command and control server, likely operated by a Chinese-speaking threat actor. This campaign poses significant risks to Indonesia's digital transformation efforts and public trust in government institutions. The successful targeting of TASPEN creates a dangerous precedent for attacks on other critical financial entities across Southeast Asia.

Anatsa, an Android banking malware first discovered in 2020, has evolved with new capabilities and targets. The latest variant now affects over 831 financial institutions worldwide, including new countries and cryptocurrency platforms. Anatsa has streamlined its payload delivery, implemented DES runtime decryption, and added device-specific restrictions. The malware uses decoy applications in the Google Play Store, some exceeding 50,000 downloads. Alongside Anatsa, 77 other malicious apps from various families were identified, totaling over 19 million installs. Anatsa's evasion techniques include emulation checks, device model verification, and the use of malformed archives to hide malicious code. The malware primarily steals credentials through fake banking login pages tailored to detected financial apps on the user's device.

Malware#coper#harlyGermany+6

The complete source code for ERMAC V3.0, an advanced banking trojan, was discovered and analyzed, providing rare insight into this active Malware-as-a-Service platform. ERMAC has evolved to target over 700 financial and cryptocurrency apps, employing sophisticated form injection techniques and encrypted communications. The analysis revealed critical vulnerabilities, including hardcoded credentials and default tokens, which could be exploited to disrupt operations. The malware's infrastructure consists of a Laravel-based C2 backend, React control panel, Golang exfiltration service, and an obfuscated Android backdoor. This comprehensive examination exposes the operational risks of the MaaS model and equips defenders with concrete methods to track, detect, and disrupt active ERMAC campaigns.

Malware#banking trojan#exfiltration serverGermany+9

A sophisticated Android banking trojan named RedHook has been discovered targeting Vietnamese users through spoofed government and financial websites. The malware uses WebSocket to communicate with its command-and-control server and supports over 30 remote commands, enabling complete control over compromised devices. RedHook combines phishing, RAT, and keylogging capabilities to exfiltrate credentials and conduct fraud. It abuses Android's MediaProjection API for screen capture and sends data to a live C2 server. The malware's low antivirus detection rate makes it a stealthy and active threat. Code artifacts suggest development by a Chinese-speaking threat actor or group. An exposed AWS S3 bucket revealed operational data dating back to November 2024, indicating a shift from previous scam campaigns to this advanced banking trojan.

Malware#banking trojan#keyloggingVietnam+4

Hive0131 is conducting email campaigns targeting users in Colombia with fake electronic notifications of criminal proceedings, purportedly from The Judiciary of Colombia. The campaigns deliver DCRat, a banking trojan operated as Malware-as-a-Service, through embedded links or PDF lures. DCRat's presence has increased in Latin America since 2024. The infection chain involves downloading a loader called VMDetectLoader, which uses process hollowing to inject DCRat into memory. VMDetectLoader can detect virtual machines and create persistence through scheduled tasks or registry keys. DCRat has various capabilities including recording victims, file manipulation, and keystroke logging. IBM X-Force assesses that Latin America will continue facing targeting from actors deploying banking trojans via phishing campaigns.

Campaign#banking trojan#process hollowingSpain+6