{"id":8127,"date":"2022-01-31T15:28:05","date_gmt":"2022-01-31T15:28:05","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/01\/31\/malware-masquerading-as-android-2fa-app-infected-10000-phones-before-removal\/"},"modified":"2022-01-31T15:28:05","modified_gmt":"2022-01-31T15:28:05","slug":"malware-masquerading-as-android-2fa-app-infected-10000-phones-before-removal","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/01\/31\/malware-masquerading-as-android-2fa-app-infected-10000-phones-before-removal\/","title":{"rendered":"Malware Masquerading as Android 2FA App Infected 10,000 Phones Before Removal"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n
This site may earn affiliate commissions from the links on this page. Terms of use<\/a>.<\/div>\n

\t\t\t\t\t\t<\/p>\n

\n
\n \t \t \"Malware<\/div>\n<\/p><\/div>\n

There are almost three and a half million apps in the Play Store, and despite Google\u2019s alleged best efforts, malware still slips through every now and then. One recently removed app was particularly malicious, masquerading as a two-factor code manager. Known simply as 2FA Authenticator<\/a>, the app picked up more than 10,000 installs until security researchers identified it as a vehicle for trojan-dropper malware<\/a>.\u00a0<\/span><\/p>\n

We (and others) are always recommending two-factor authentication (2FA) as one of the best ways to secure your online accounts. Some services rely on one-time SMS codes, but 2FA apps like Google Authenticator and Authy make it easier to manage multiple 2FA tokens. 2FA Authenticator was actually a functional 2FA app \u2014 it used the open source Aegis authentication application as a base, but under that it contained the Vultur malware.\u00a0<\/span><\/p>\n

The genius of this malware is that it looked legit. You wanted a 2FA app, well this one did the job. 10,000+ people decided to give 2FA Authenticator a shot over more established names. However, the app would abuse Android permissions to copy your app list, location, and other personal information. Vultur is banking malware, which aims to steal credentials and financial information. It would also attempt to disable the lock screen and download third-party apps by pretending they are app updates. This behavior is suspicious for anyone who\u2019s familiar with how Android works, but that\u2019s not most people.\u00a0<\/span><\/p>\n

\"\"<\/p>\n

Before its removal, 2FA Authenticator picked up more than 10,000 downloads.<\/p>\n<\/div>\n

Perhaps the most troubling innovation in this piece of malware is an implementation of the VNC screen-sharing application. You can probably see where this is going. When people put their 2FA keys into this app, the attacker could watch in real-time to swipe banking details and two-factor codes.\u00a0<\/span><\/p>\n

The app was live for about two weeks, reports Ars Technica<\/a>, longer than most malware that slips into the Play Store. It\u2019s likely that the app\u2019s functional 2FA capabilities helped it fly under the radar for a period of time. Google has tools to remotely nuke apps downloaded from the Play Store, but it\u2019s unclear if it has done so in this case. Anyone who worries they downloaded the app should factory reset the phone and start changing passwords. The package name is \u201ccom.privacy.account.safetyapp.\u201d If you see that in your app settings, it\u2019s time to panic.<\/span><\/p>\n

Now Read:<\/strong><\/p>\n

<\/span>\n\t\t\t\t\t<\/div>\n