226 apps may face danger from Alien malware, a new strain of Android malware
By MYBRANDBOOK
Security researchers have discovered and analyzed a new strain of Android malware that comes with a wide array of features allowing it to steal credentials from 226 applications.
Alien, a new Trojan has been active since the start of the year and has been offered as a Malware-as-a-Service (MaaS) offering on underground hacking forums.
In a report shared this week, security researchers from ThreatFabric, an omnichannel solution to data malware etc; dug deep into forum posts and Alien samples to understand the malware's evolution, tricks, and features.
According to researchers, Alien is not truly a new piece of code but was actually based on the source code of a rival malware gang named Cerberus.
Cerberus, while an active MaaS last year, fizzled out this year, with its owner trying to sell its codebase and customer base, before eventually leaking it for free.
Digital solution portal, ThreatFabric says Cerberus died out because Google's security team found a way to detect and clean infected devices. But even if Alien was based on an older Cerberus version, Alien doesn't seem to have this problem and its MaaS stepped in to fill the void left by Cerberus' demise.
And researchers say that Alien is even more advanced than Cerberus, a reputable and dangerous trojan in its own right. ThreatFabric says Alien is part of a new generation of Android banking trojans that have also integrated remote-access features into their codebases.
This makes Alien a dangerous concoction to get infected with. Not only can Alien show fake login screens and collect passwords for various apps and services, but it can also grant the hackers access to devices to use said credentials or even perform other actions.
That's quite an impressive array of features. ThreatFabric says these are mostly used for fraud-related operations, as most Android trojans tend to be these days, with the hackers targeting online accounts, searching for money.
During its analysis, researchers said they found that Alien had support for showing fake login pages for 226 other Android applications
However, Alien targeted other apps as well, such as email, social, instant messaging, and cryptocurrency apps (i.e., Gmail, Facebook, Telegram, Twitter, Snapchat, WhatsApp, etc.).
Most of the banking apps targeted by Alien developers were for financial institutions based mostly in Spain, Turkey, Germany, the US, Italy, France, Poland, Australia, and the UK.
ThreatFabric didn't include details about how Alien makes its way onto users' devices, primarily because this varies based on how the Alien MaaS customers (other criminal groups) chose to distribute it.
"A lot of it seems distributed via phishing sites, for example malicious page tricking the victims into downloading fake software updates or fake Corona apps (still a common trick at the moment)," Gaetan van Diemen, a malware analyst at ThreatFabric said
"Another method observed to be used is the SMS, once they infect a device they collect the contact list which they then reuse for further spreading of their malware campaign," he added.
Some malicious apps make it on the Play Store, once in a while, but most of the time, they're distributed through other channels, van Diemen said.
All of these shady Alien-tainted apps can be easily be spotted as they often require users to grant them access to an admin user or to the Accessibility service.
As self-evident of an advice "don't install apps from shady sites and grant them admin rights" might sound, not all Android users are technical enough to understand it, and many users will download and install apps from any location, and then just click through all the prompts during installations.
This is how malware operates in general, targeting non-technical users, and not the "experts." And there are many of these non-technical users around, hence why Android malware is big business these days on hacking forums.
TAC Security becomes Cyber Security Assessor for the App Defen
The cybersecurity company, TAC Security has been selected as a key Cyber ...
InterGlobe’s Rahul Bhatia and C.P. Gurnani together announce
In a move that is set to transform the AI landscape, Rahul Bhatia, Group M...
Download masked Aadhaar to improve privacy
Download a masked Aadhaar from UIDAI to improve privacy. Select masking w...
Sterlite Technologies' Rs 145 crore claim against BSNL rejecte
An arbitrator has rejected broadband technology company Sterlite Technolog...
INFOSYS TECHNOLOGIES PVT. LTD.
MICROTEK INTERNATIONAL PVT. LTD.
DIGISOL SYSTEMS LTD.
RAMCO SYSTEMS Ltd.
Technology Icons Of India 2023: Lt Gen (Dr.) Rajesh Pant (Retd.)
LT Gen(Dr.) Rajesh Panth (Retd.), National cyber security coordination...
Technology Icons Of India 2023: Honorary Prof. N. Balakrishnan
Prof. N. Balakrishnan is an Indian aerospace and computer scientist. H...
Technology Icons Of India 2023: Amit Chadha
. An influential leader in the engineering services industry for over ...
PGCIL transforming India with its wide power transmission network
Engaged in power transmission, POWERGRID or PGCIL is a stated owned In...
RailTel connecting every corner of India
RailTel is an ICT provider and one of the largest neutral telecom infr...
C-DOT enabling India in indigenous design, development and production of telecom technologies
An autonomous telecom R&D centre of Government of India, Center of Dev...
TECHNOBIND SOLUTIONS PVT. LTD.
TechnoBind’s business model is focused on identifying and partnering...
TEXONIC INSTRUMENTS
Texonic has carved a niche for itself in the Technology Distribution i...
Crayon Software Experts India Pvt Ltd
Crayon helps its customers build the commercial and technical foundati...