Threats Tagged 'sturnus'

StreamRat is an Android banking trojan distributed via Meta and TikTok ads disguised as a free TV-streaming app targeting Spanish-speaking users, mainly in Spain. It uses a two-stage installation with a dropper that disables internet connectivity through fake VPN connections. After installation, it abuses Accessibility Services and the MediaProjection API to grant attackers near-complete control over the device, including VNC remote control, hidden screen manipulation, keylogging, credential-stealing overlays, UI data collection, and screen blocking. The malware operates as a Malware-as-a-Service with a multi-role control panel and WebSocket-based command and control communications. The campaign potentially affected around 570,000 users. No official patch or remediation guidance is currently available.

MediumMalwareSpain#accessibility services#mediaprojection#streamrat

Sturnus is a newly identified Android banking trojan targeting financial institutions in Southern and Central Europe. It features advanced capabilities such as full device takeover, harvesting banking credentials, keylogging, and remote control via VNC. Notably, it can bypass encryption on popular messaging apps like WhatsApp, Telegram, and Signal to monitor communications. The malware uses sophisticated communication protocols including WebSocket and HTTP to interact with its command-and-control servers. Although still in development and not yet exploited in the wild, Sturnus poses a significant threat to financial security and user privacy. It employs HTML overlays for data exfiltration and extensive environment monitoring to evade detection. The malware’s complexity and targeting of Android devices make it a serious concern for European financial sectors. Defenders should prioritize detection and containment measures to mitigate potential impacts.

MediumCampaignItalySpainFrance+4#banking trojan#remote control#europe