{"id":15592,"date":"2022-02-21T16:09:17","date_gmt":"2022-02-21T16:09:17","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/21\/new-android-xenomorph-banking-malware-targets-european-banks\/"},"modified":"2022-02-21T16:09:17","modified_gmt":"2022-02-21T16:09:17","slug":"new-android-xenomorph-banking-malware-targets-european-banks","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/21\/new-android-xenomorph-banking-malware-targets-european-banks\/","title":{"rendered":"New Android ‘Xenomorph’ banking malware targets European banks"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

A newly detailed form of Android banking malware has been found to be targeting 56 different European banks.<\/p>\n

Discovered by<\/a> researchers at ThreatFabric and revealed today, the banking trojan has been dubbed \u201cXenomorph\u201d because it has its roots in a previous form of Android malware called Alien. The Alien mobile malware was first detected in January 2020<\/a> and was a fork of the Cerberus Android malware.<\/p>\n

The Xenomorph name makes sense since it\u2019s the third-generation variant of the original Cerberus malware. While having fallen out of favor with hackers, Cerberus once made headlines, such as in\u00a0February 2020,<\/a> for compromising Google LLC Authenticator.<\/p>\n

Sadly but not surprisingly, Xenomorph has been found in applications on the Google Play Store. The ThreatFabric researchers note that while Google has seemingly taken some action to reduce the number of malicious applications on its store, these efforts are not enough to stop criminals from reaching the store.<\/p>\n

As is typical with Android malware distribution,\u00a0Xenomorph is hidden in what appear to be legitimate applications. One such application was \u201cFast Cleaner.\u201d The app was pitched as speeding up a device by removing unused clutter and removing battery optimization blocks. Before being removed from Google Play, the app had more than 50,000 installations.<\/p>\n

Xenomorph uses an overlay attack to steal credentials. In an overlay attack, a malicious app opens and activates a window over a legitimate program. This layer fully replicates the target product interface, with the user being none the wiser. Given that Xenomorph targets 56 European banks, a user opening their banking app would be presented with a screen that appeared to be their banking app but was actually a fake overlay of their login screen.<\/p>\n

To make matters worse,\u00a0Xenomorph also intercepts SMS messages and two-factor authentication programs to intercept and gain access to victims\u2019 bank accounts.<\/p>\n

The researchers add that\u00a0Xenomorph appears to be in its early stages of development \u2014 in their words, its \u201cinfancy\u201d stage. That\u2019s based on code analysis that many commands are present in the malware that have not yet been implemented.<\/p>\n

\u201cThe surfacing of Xenomorph shows, once again, that threat actors are focusing their attention on landing applications on official markets,\u201d the ThreatFabric researchers conclude. \u201cThis is also a signal that the underground market for droppers and distribution actors has increased its activity.\u201d<\/p>\n

Image:\u00a0ThreatFabric<\/h5>\n
\n
\n

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.<\/span><\/h3>\n<\/div><\/div>\n