New FjordPhantom Android Malware Targets Banking Apps in Southeast Asia

Cybersecurity scientists have disclosed a new subtle Android malware identified as FjordPhantom that has been noticed focusing on customers in Southeast Asian countries like Indonesia, Thailand, and Vietnam considering that early September 2023.

“Spreading largely through messaging providers, it brings together app-based mostly malware with social engineering to defraud banking consumers,” Oslo-dependent mobile app security business Promon mentioned in an evaluation printed Thursday.

Propagated generally by way of email, SMS, and messaging applications, attack chains trick recipients into downloading a purported banking application that comes fitted with legit capabilities but also incorporates rogue elements.

Victims are then subjected to a social engineering system akin to telephone-oriented attack shipping (TOAD), which consists of calling a bogus contact heart to acquire action-by-step instructions for working the application.

A critical characteristic of the malware that sets it aside from other banking trojans of its form is the use of virtualization to run destructive code in a container and fly below the radar.

The sneaky approach, Promon stated, breaks Android’s sandbox protections as it lets distinctive applications to be operate on the very same sandbox, enabling the malware to obtain sensitive details with no demanding root accessibility.

“Virtualization remedies like the a single utilized by the malware can also be utilised to inject code into an application simply because the virtualization solution very first masses its very own code (and all the things else uncovered in its app) into a new process and then hundreds the code of the hosted software,” security researcher Benjamin Adolphi claimed.

In the circumstance of FjordPhantom, the host application downloaded consists of a malicious module and the virtualization component which is then utilized to put in and start the embedded app of the specific bank in a digital container.

In other words, the bogus application is engineered to load the bank’s reputable application in a digital container though also employing a hooking framework inside the surroundings to change the actions of vital APIs to grab delicate facts from the application’s display screen programmatically and shut dialog packing containers employed to warn destructive exercise on users’ gadgets.

“FjordPhantom by itself is penned in a modular way to attack distinctive banking apps,” Adolphi reported. “Dependent on which banking application is embedded into the malware, it will perform different attacks on these applications.”

Located this write-up attention-grabbing? Comply with us on Twitter  and LinkedIn to browse much more exclusive articles we publish.

Some parts of this article are sourced from:
thehackernews.com