Hidden within these apps are mobile banking trojans that swing into action when you launch a legitimate banking or financial app. They deceive users by displaying a fake login page over authentic pages to gain access to account credentials. The malware also keeps track of notifications to get the OTP and are also capable of abusing Accessibility services to do on-device financial fraud.
The most widely targeted app is the global online banking platform BBVA which has tens of millions of downloads. Seven out of the ten most prolific banking malware are known to target this app.
Most of these apps are targeted by a trojan called Teabot, which covers 410 out of the 639 apps tracked, and Exbot comes second, affecting 324 apps.
Other trojans that were quite active during the first quarter of 2021 include:
- BianLian which targets Binance, BBVA, and many Turkish apps.
- Cabassous which is after Barclays, CommBank, Halifax, Lloys, and Santander customers.
- Coper may take over BBVA, Caixa Bank, CommBank, and Santander accounts.
- EventBot which targets Barclays, Intensa, BancoPosta, and a host of Italian apps. This one disguises itself as Microsoft Word or Adobe Flash.
- Aforementioned Exobot which may affect PayPal, Binance, Cash App, Barclays, BBVA, and CaixaBank,
- FluBot which impacted BBVA, Caixa, Santander, and various Spanish apps.
- Medusa which targeted BBVA, CaixaBank, Ziraat, and Turkish banking apps.
- Sharkbot which affected Binance, BBVA, and Coinbase.
- Teabot targets PhonePe, Binance, Barclays, Crypto.com, Postepay, Bank of America, Capital One, Citi Mobile, and Coinbase.
- Xenomorph targets BBVA and many EU-specific bank apps.
!function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version=’2.0′;n.queue=[];t=b.createElement(e);t.async=!0;t.src=v;s=b.getElementsByTagName(e)[0];s.parentNode.insertBefore(t,s)}(window,document,’script’,’https://connect.facebook.net/en_US/fbevents.js’);fbq(‘init’,’950812218873147′);fbq(‘track’,’PageView’);
