The exploitation of financial apps by trojans has become prevalent, according to a report by Zimperium, a mobile security firm. Trojans are a type of malware that infects users' devices by posing as legitimate and trustworthy programs. The researchers looked at ten separate trojans that are currently active in the open and discovered that they target 639 financial Android apps when combined.
Once they've infected a device, they leverage Accessibility services to take actions as the user, overlaying login pages on top of authentic banking and finance apps to steal login details, monitoring notifications to capture OTPs, and even carrying out on-device financial fraud. This is particularly concerning because, according to 2021 studies, three out of four Americans use banking applications to conduct their regular financial activities, offering a large target pool for these trojans.
The Google Play Store has slightly over 1 billion downloads of these mobile banking, investment, payment, and cryptocurrency apps combined. PhonePe, which is immensely popular in India and has 100 million downloads on the Play Store, is the targeted application with the most downloads.
The popular bitcoin exchange software Binance has received 50 million downloads. Cash App is a mobile payment service that is available in the United States and the United Kingdom, with 50 million downloads on Google Play. Even though they don't provide traditional financial services, some banking Trojans target both of these. BBVA, a worldwide online banking platform with tens of millions of downloads, is the most widely marketed application. Seven of the ten most active banking trojans have been found to target this app.
Additional trojans which were active during the first half of 2021 include the following:
- BianLian is a malware that targets Binance, BBVA, and several Turkish apps.
- Cabassous is after clients from Barclays, CommBank, Halifax, Lloys, and Santander.
- Coper may take over accounts from BBVA, Caixa Bank, CommBank, and Santander.
- Barclays, Intensa, BancoPosta, and a slew of other Italian apps are among the targets of EventBot. This one uses Microsoft Word or Adobe Flash to hide its true identity.
- PayPal, Binance, Cash App, Barclays, BBVA, and CaixaBank may all be affected by the aforementioned Exobot.
- FluBot affected BBVA, Caixa, Santander, and several other Spanish apps.
- Medusa was a banking app that targeted BBVA, CaixaBank, Ziraat, and Turkish banks.
- Binance, BBVA, and Coinbase were all hit by Sharkbot.
- PhonePe, Binance, Barclays, Crypto.com, Postepay, Bank of America, Capital One, Citi Mobile, and Coinbase are among the companies targeted by Teabot.
- BBVA and a slew of other EU-specific bank apps are among those targeted by Xenomorph.
The method utilized by these trojans would be that they each have a small target scope and different types of functionality for diverse goals.
Because these trojans are concealed among programs available on Android's official app store, users should be cautious and avoid downloading apps from untrustworthy sources. One may take it a step further by using a provider like ExpressVPN.
