Kaspersky discovered a news strain of the mobile banking Trojan Faketoken that displays overlays on top of taxi booking apps to steal banking information.
Security experts from Kaspersky have discovered a news strain of the infamous mobile banking trojan Faketoken that implements capabilities to detect and record an infected device’s calls and display overlays on top of taxi booking apps to steal banking information.
“The authors of its newer modifications continue to upgrade the malware, while its geographical spread is growing. Some of these modifications contain overlay mechanisms for about 2,000 financial apps. In one of the newest versions, we also detected a mechanism for attacking apps for booking taxis and paying traffic tickets issued by the Main Directorate for Road Traffic Safety.” states the analysis published by Kaspersky.
In December, Kaspersky observed the Android ransomware Faketoken was enhanced with file-encrypting abilities.
Now the new variant of the malware dubbed Faketoken.q was improved again to steal credentials from Uber and other booking apps as well.
Deployment Strategy:
The method of deployment is very straightforward – Faketoken.q is being distributed using bulk SMS messages to trick users into downloading an image file that actually downloads the malware. One could consider this a mobile spear phishing attack because users typically click on links in emails and SMS messages when they come from people they trust either through a spoofed account or phone number.
The mobile Trojan is composed of two parts, the first part is an obfuscated dropper (verdict: Trojan-Banker.AndroidOS.Fyec.az), the second one is a file with DAT extensions that contains the malware’s main features.
Once victims have downloaded the Android malware it installs the necessary modules and the main payload, which hides its shortcut icon and starts monitoring user’s activities, including calls to launched apps.
“After the Trojan initiates, it hides its shortcut icon and starts to monitor all of the calls and whichever apps the user launches. Upon receiving a call from (or making a call to) a certain phone number, the malware begins to record the conversation and sends it to evildoers shortly after the conversation ends.” continues the analysis.
When the calls are made to or received from certain phone numbers, Faketoken.q records the conversations and sends the recordings to the attacker’s server. The malicious code also checks which apps the victim is using and when detects the launch of an app whose interface it can clone, it overlays the app with a fake user interface.
The fake user interface presented by Faketoken.q prompts victims to enter their payment card data, including the bank’s verification code.
Researchers observed that the malware is able to display fake interface for many mobile banking apps and other applications, such as:
- Android Pay
- Google Play Store
- Apps for paying traffic tickets
- Apps for booking flights and hotel rooms
- Apps for booking taxis
The Trojan is able to intercept the incoming SMS messages to obtain the SMS code sent by the bank to authorize transactions, then it forwards the code to the command and control (C&C) server.
It seems that Faketoken.q was initially developed to target Russian-speaking users because it currently only uses the Russian language on the user interface.
Avoidance:
To avoid being infected by Faketoken and apps similar malware, do not install applications from third-party stores and pay attentions to unsolicited SMS and email messages you receive on your mobile device.
Remember, it’s best to call a friend on the phone and ask them if they just sent you an email or an SMS message,especially when there are attachments. Spear phishing and remote access trojans have become the number one method of malware deployment on traditional Windows, Linux and Mac platforms, now this model is moving to mobile so expect to see more malware targeted at Google Android and Apple iOS mobile devices.
Pierluigi Paganini, Editor-in-Chief, Cyber Defense Magazine
with Gary S. Miliefsky, Executive Producer, Cyber Defense Magazine
