Sunday , June 1 2025
CYFIRMA

FinStealer Malware Targets Indian Bank’s Mobile Users, Stealing Credentials

CYFIRMA analysis reveals a sophisticated malware campaign that exploits a major Indian bank’s brand through fake mobile apps. These apps, distributed via phishing links and social engineering, closely resemble the real bank apps, deceiving users into sharing their credentials and personal information. The malware uses advanced techniques, such as encrypted communication with C2 servers and altering its behavior, allowing it to evade detection by security systems.

The attackers aim to profit by stealing credentials, making unauthorized transactions, and selling stolen banking and personal data on darknet forums. This campaign may also help them set up larger fraud operations, allowing for money laundering, identity theft, and further exploitation of compromised accounts.

Hacker claim Leak of Deloitte Source Code & GitHub Credentials

A hacker known as "303" claim to breach the company's systems and leaked sensitive internal data on a dark web...
Read More
Hacker claim Leak of Deloitte Source Code & GitHub Credentials

CISA Issued Guidance for SIEM and SOAR Implementation

CISA and ACSC issued new guidance this week on how to procure, implement, and maintain SIEM and SOAR platforms. SIEM...
Read More
CISA Issued Guidance for SIEM and SOAR Implementation

Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora

The Qualys Threat Research Unit (TRU) found two local information-disclosure vulnerabilities in Apport and systemd-coredump. Both issues are race-condition vulnerabilities....
Read More
Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora

Australia enacts mandatory ransomware payment reporting

New ransomware payment reporting rules take effect in Australia yesterday (May 30) for all organisations with an annual turnover of...
Read More
Australia enacts mandatory ransomware payment reporting

Why Govt Demands Foreign CCTV Firms to Submit Source Code?

Global makers of surveillance gear have clashed with Indian regulators in recent weeks over contentious new security rules that require...
Read More
Why Govt Demands Foreign CCTV Firms to Submit Source Code?

CVE-2023-39780
Botnet hacks thousands of ASUS routers

GreyNoise has discovered a campaign where attackers have gained unauthorized access to thousands of internet-exposed ASUS routers. This seems to...
Read More
CVE-2023-39780  Botnet hacks thousands of ASUS routers

Bangladesh Bank instructed using AI to prevent online gambling

The rise of online gambling in the country is leading to increased crime and societal issues. In response, the central...
Read More
Bangladesh Bank instructed using AI to prevent online gambling

251 Amazon-Hosted IPs Used in Exploit Scan for ColdFusion, Struts, and Elasticsearch

Cybersecurity researchers recently revealed a coordinated cloud-based scanning attack that targeted 75 different exposure points earlier this month. On May...
Read More
251 Amazon-Hosted IPs Used in Exploit Scan for ColdFusion, Struts, and Elasticsearch

Zero-Trust Policy bypass to Exploit Vulns & Manipulate NHI Secrets

Recent security research has shown that attackers can weaken zero-trust security frameworks by exploiting a key DNS vulnerability, disrupting automated...
Read More
Zero-Trust Policy bypass to Exploit Vulns & Manipulate NHI Secrets

Evaly E-commerce Platform Allegedly Hacked

Evaly, a Bangladeshi e-commerce platform, is reportedly facing a major data breach that may have exposed sensitive information of around...
Read More
Evaly E-commerce Platform Allegedly Hacked

FinStealer malware employs advanced evasion methods to evade security systems. It uses encrypted communication with Command-and-Control servers, executes dynamic payloads, and alters its behavior during runtime. It also utilizes XOR encryption and Telegram bots for added complexity and data theft.

Attackers exploit vulnerabilities like SQL injection (CVE-2011-2688) to compromise command and control servers, gaining unauthorized access to critical information such as server passwords.

Once installed on a device, the malware gains permission to access SMS messages, allowing it to intercept one-time passwords (OTPs) and other sensitive information. This enables attackers to bypass multi-factor authentication (MFA), leading to unauthorized transactions and identity theft. Its undetected nature highlights its sophistication, posing serious risks to individual users and financial institutions.

Cyfirma researchers found that malware is linked to a fake website that hosts counterfeit versions of a bank’s app. This site spreads malware through phishing campaigns disguised as ads or download prompts. The campaign highlights vulnerabilities in mobile banking systems, especially in areas with high use of digital financial services.

The malware uses a Telegram bot to send sensitive data to its command and control server including:

Banking credentials
Credit card details
Personal identification information

Security researchers also discovered a critical vulnerability (CVE-2011-2688) in the C2 server, allowing SQL injection attacks through the mysql/mysql-auth.pl script in the mod_authnz_external module.

CYFIRMA recommends using advanced endpoint protection, monitoring for suspicious behavior, regularly auditing mobile apps, and blocking known malicious indicators to safeguard against threats.

India to launch new domain name for banks to combat digital fraud

 

Check Also

ASUS routers

CVE-2023-39780
Botnet hacks thousands of ASUS routers

GreyNoise has discovered a campaign where attackers have gained unauthorized access to thousands of internet-exposed …

Leave a Reply

Your email address will not be published. Required fields are marked *