InfoSecBulletin Cybersecurity for mankind
An Android malware campaign that targets banks has upgraded its capabilities and added more ways to avoid detection.
A new report from Zimperium found over 200 harmful apps related to a malicious operation. The report also mentions that the threat actor has been carrying out phishing attacks on financial institutions.
Hackers Bypass Gmail MFA With App-Specific Password Reuse
Russia detects first SuperCard malware attacks via NFC
Income Property Investments exposes 170,000+ Individuals record
ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs
CISA Flags Active Exploits in Apple iOS and TP-Link Routers
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online
Canada 2nd largest airlines “WestJet” investigates cyberattack disrupting internal systems
Paraguay 7.4 Million Citizen Records Leaked on Dark Web
High-Severity Flaw in HashiCorp Nomad Allows Privilege Escalation
SoftBank: Over 137,000 personal info leaked
ALSO READ:
The campaign was discovered in July 2023 by Sophos. They found 40 apps that were stealing information from customers of 4 Iranian banks.
The primary goal of the bogus apps is to trick victims into granting them extensive permissions as well as harvest banking login credentials and credit card details by abusing Android’s accessibility services.
“The corresponding legitimate versions of the malicious apps are available at Cafe Bazaar, an Iranian Android marketplace, and have millions of downloads,” Sophos researcher Pankaj Kohli said at the time.
“The malicious imitations, on the other hand, were available to download from a large number of relatively new domains, some of which the threat actors also employed as C2 servers.”
“Some of these domains were found to serve HTML phishing pages aimed at extracting credentials from mobile users.” To read the full report click here.
