ThreatFabric managed to spot yet another Android banking remote access trojan; this one is called ‘Hirudo’. This one should be taken seriously as well, as it can deal considerable damage, it seems.
Hirudo is a dangerous new Android banking trojan
Hirudo “combines on-device credential theft with live remote control of the same phone.” This trojan is delivered by shopping and entertainment apps that carry it as a separate installation package.
Hirudo is basically sitting side-by-side with current-gen Accessibility-driven Android bankers, the company said. ThreatFabric says that there’s one thing that sets this trojan apart: “the lengths its operators go to once a bank is in their sights: rather than overlaying a fake screen on top of the genuine banking app, Hirudo attempts to replace the banking app itself with a modified copy that quietly disables the bank’s own security checks from the inside.”
This trojan basically blends credential phishing, device takeover, screen and camera capture, and SMS theft. Needless to say, that can do a lot of damage. The sheer fact that it can put a fake screen on top of a genuine banking app is a threat enough.
It can do a lot of damage, and it has a large scope of targets
It is currently covering seven banks and eight Indonesian banking apps, but there’s always a possibility it will spread. That could easily happen, as credential targets named in the code span Indonesia, China, India, Mexico, Morocco, and Thailand.
We’re seeing more and more banking trojans lately, and their goal is basically always to gain monetary gain. They’ll do everything in their power to gain your banking credentials and thus wipe your account clean.
These banking trojans are also getting more sophisticated as we move forward. So, as usual, you should be careful about what apps you’re downloading and also what websites you’re visiting.
The post This Android Banking Trojan Can Replace Your Banking App With a Tampered Copy appeared first on Android Headlines.
