'Vultur' malware uses new technique to steal banking credentials

A squad of researchers astatine the information steadfast ThreatFabric is reporting connected their website blog page that they person recovered instances of a caller benignant of malware successful Android apps downloaded from Google Play that effort to bargain banking login information. They person named the caller malware Vultur, aft the birds that prey connected wounded oregon dormant targets.

The squad astatine ThreatFabric enactment that anterior efforts to bargain banking login and password accusation from users of Android-based devices person utilized overlays; wherever an representation is pasted implicit the apical of an application's login leafage and information from it is past routed to the hackers. In this caller threat, the Vultur bundle alternatively uses codification to admit erstwhile a information introduction signifier is being used, takes a surface grab, and past begins keylogging. All of the information captured by the malware is past routed to a tract specified by its creators.

The squad astatine ThreatFabric notes that frankincense far, Vultur has mostly affected radical surviving successful Italy, Australia, the U.K and the Netherlands—and portion its premier ngo appears to beryllium capturing banking login information, instances of keylogging person besides been recovered for societal media apps, specified arsenic TikTok, Facebook and WhatsApp—they person besides seen a fewer instances of cryptocurrency apps being targeted arsenic well.

The malware tin marque its mode onto idiosyncratic devices via a "dropper" called Brunhilda, which has been recovered successful respective phone-security, fittingness and authentication apps—all connected Google Play. The squad astatine ThreatFabric is estimating that astir 30,000 Android-based devices person been infected with Brunhilda to date, which suggests that thousands of users person apt been infected with Vultur. They besides enactment that Vultur makes usage of Accessibility Services connected infected devices to forestall users from removing it from their device—it instigates a Back fastener property if specified an effort is made.

Users tin forestall the malware from stealing their information by denying entree erstwhile notified by Accessibility Services. Also, the malware tin beryllium detected by a casting icon appearing erstwhile users are not casting something. ThreatFabric besides suggests installing Android antivirus apps.

---

---

© 2021 Science X Network