Fraud Management & Cybercrime
,
Malware as-a-Service
New Trojan May Soon Be Offered for Sale to Criminal Underground
Android users in search of streaming TV apps outside of official app stores are targets for a new banking Trojan security researchers dub Massiv.
See Also: AI vs. AI: Leveling the Defense Playing Field
This threat, observed by ThreatFabric, “poses great risk to the users of mobile banking,” but is evidence of how criminals have caught on that modern banking Trojans need highly convincing side-loading bait for users to download them.
Users of IPTV apps are already accustomed to looking outside of official app stores for downloads, since the promise of many off-brand apps is access to premium or region-restricted content.
“Since IPTV users find it very natural to look for these apps outside of the store, creating a fake website of a new attractive app – or faking an existing one – allows threat actors to keep the user unsuspicious about the necessity to install the application from unknown sources,” ThreatFabric researchers wrote.
Named Massiv after one of its components, the malware is one of many recent Trojans to masquerade as an IPTV app. Hackers have used that lure with mounting frequency over the past six to eight months, ThreatFabric said, particularly in malicious apps targeting users in Spain, Portugal, France and Turkey.
The malware houses all the features required to establish persistence. Like almost every Android Trojan, it pushes users into authorizing access to the operation system’s accessibility service.
Once installed, it displays overlay pages for targeted apps. One campaign targeted the Portuguese government application gov.pt, asking the victim for phone number and PIN code.
Massiv supports two types of data capture – screen streaming and “UI-tree mode.” For screen streaming, it relies on the MediaProjection API, “effectively sharing the screen content with the remote operator.” Some apps have protections against screen capture, so in those cases, Massive recursively processes AccessibilityNodeInfo objects to build a JSON representation of data such as visible text and interaction flags.
ThreatFabric said it hasn’t observed Massiv being marketed on criminal forums as malware as a service. But its operator “shows clear signs of going this path, introducing API keys to be used in malware communication with the backend.” Code analysis revealed ongoing development, with more features likely to be introduced in the future.