Trojan targets major Australian bank apps
Millions of Australian banking customers are at risk of falling victim to a mobile banking Trojan capable of stealing login details from the nation's major banks.
The Android Trojan campaign targets customers of banks including Westpac, ANZ, Commonwealth Bank, NAB, St George Bank and Bendigo Bank according to ESET Australia, which discovered the campaign.
The Trojan is capable of mimicking the login screens of 20 mobile banking apps from Australia, New Zealand and Turkey, as well as PayPal, Skype, eBay and several Google services.
It is designed to steal login credentials and also has the ability to intercept SMS communications to bypass SMS-based two-factor authentication.
The Trojan masquerades as a Flash Player app with a legitimate-looking icon and is available on services registered earlier this year.
After downloading and installing the malicious app, the user is prompted to grant the app administrator rights.
On installation, the app is designed to scan for a list of 49 target apps — not all of which are currently directly attacked — and activate if one is found. The malware then manifests as an overlay appearing over the launched application.
This overlay functions as a lock screen that can't be closed unless the user submits login credentials. These credentials are then sent to a remote server and the overlay closes. The malware also attempts to obtain Google account credentials.
Removing the malware requires the user to deactivate administrative privileges — which the Trojan is capable of circumventing by launching an overlay preventing the user for confirming the command — or booting into safe mode.
The full list of banks targeted by the Trojan is: Westpac, Bendigo Bank, Commonwealth Bank, St George Bank, National Australia Bank, Bankwest, Me Bank, ANZ Bank, ASB Bank, Bank of New Zealand, Kiwibank, Wells Fargo, Halkbank, Yapı Kredi Bank, VakıfBank, Garanti Bank, Akbank, Finansbank, Türkiye İş Bankası and Ziraat Bankası.
Too much of a good thing: Australia's cyber overlap issue
Recent research indicates many organisations may have too many security systems with overlapping...
The true cost of cyber attacks
The average annual expense of recovering and dealing with cyber attacks has surpassed AU$4.1...
Tackling the human element in modern authentication: the phishing-resistant user
Integrating human-centric cybersecurity strategies is not merely an option but a necessity in...
