A fake two-factor-authentication app that has been downloaded some 10,000 times from Google Play surreptitiously installed a known banking-fraud trojan that scoured infected phones for financial data and other personal information, security firm Pradeo said.
2FA Authenticator went live on Google Play two weeks ago, posing as an alternative to legitimate 2FA apps from Google, Twilio, and other trusted companies. In fact, researchers from security firm Pradeo said on Thursday, the app steals personal data from user devices and uses it to determine whether infected phones should download and install a banking trojan already known to have infected thousands of phones in the past.
The malicious 2FA Authenticator has no connection to this 2FA Authenticator, which is also a mobile app, in this case for both iOS and Android, and there are no indications the latter is malicious in any way. A common tactic among malware purveyors is to name their apps after already-established title.
The vulturs are circling
Discovered last year by security firm ThreatFabric, Vultur is an advanced piece of Android malware. One of its many innovations is its use of a real implementation of the VNC screen-sharing application to mirror screens of infected devices so attackers can glean in real time the login credentials and other sensitive data from banking and finance apps.
To make 2FA Authenticator look real, its developers started with this legitimate sample of the open source Aegis authentication application. An analysis of the malware shows that it really was programmed to provide the authentication service it advertised.
Behind the scenes, however, stage one of the 2FA Authenticator collected a list of apps installed on the device along with the device’s geographic location. The app would also disable the Android lock screen, download third-party apps with the pretense they were “updates,” and overlay other mobile app interfaces to confuse users.
Loading comments...
