Malicious Google Play Store App Spotted Distributing Xenomorph Banking Trojan

Google has eliminated two new destructive dropper apps that have been detected on the Play Retailer for Android, a person of which posed as a life-style application and was caught distributing the Xenomorph banking malware.

“Xenomorph is a trojan that steals credentials from banking programs on users’ products,” Zscaler ThreatLabz researchers Himanshu Sharma and Viral Gandhi claimed in an analysis posted Thursday.

“It is also capable of intercepting users’ SMS messages and notifications, enabling it to steal one particular-time passwords and multi-variable authentication requests.”

The cybersecurity organization stated it also observed an expense tracker app that exhibited very similar conduct, but noted that it couldn’t extract the URL utilized to fetch the malware artifact.

The two malicious apps are as follows –

• Todo: Working day supervisor (com.todo.daymanager)
• 経費キーパー (com.setprice.expenditures)

Each the apps perform as a dropper, indicating the applications by themselves are harmless and are a conduit to retrieve the actual payload, which, in the circumstance of Todo, is hosted on GitHub.

Xenomorph, first documented by ThreatFabric previously this February, is acknowledged to abuse Android’s accessibility permissions to perform overlay attacks, whereby bogus login screens are presented atop legit lender applications to steal victim’s credentials.

What is actually far more, the malware leverages a Telegram channel’s description to decode and construct the command-and-command (C2) area applied to receive supplemental instructions.

The improvement follows the discovery of 4 rogue apps on Google Participate in that ended up uncovered directing victims to malicious internet sites as aspect of an adware and facts-thieving marketing campaign. Google informed The Hacker Information that it has since banned the developer.

Found this report appealing? Observe THN on Fb, Twitter  and LinkedIn to read through more unique written content we publish.

Some parts of this article are sourced from:
thehackernews.com