Android RAT malware invades mobile banking apps

A new Android-based RAT malware has threatened to invade users’ mobile banking apps

Mobile malware

A new remote access Trojan malware for Android devices, dubbed com.II, is threatening users' mobile banking data, SMS messages and contact lists.

According to a blog by security vendor FireEye, the offending RAT is able to disable anti-virus systems Android users have in place, before scanning for banking apps and replacing them with fake ones. The malware then installs malicious app updates, steals and sends SMS messages and gains access to contact lists.

The blog claims that com.II "takes Android malware to a new level" by combining so many unwanted activities into a single app. The malware contains a feature called Bank Hijack' and is targeting eight banks in Korea, with fears this could quickly expand to many more.

Paco Hope, principle consultant with Cigital and a UK-based malware expert, restated concerns the RAT could pose a significant threat to mobile banking customers worldwide.

Speaking to SCMagazineUK, he said: "Because of its abstraction, it is likely that it will be used to target lots of different banking populations, and will probably be customised by region, language or jurisdiction.

"Malware of this nature also highlights the role the app store plays in securing a device. Users who accept apps from sources other than the official stores run a much higher risk of installing malware. For all their faults, the official Google and Apple stores play a significant role in protecting the average user from malware. The dangers of third-party app sources are very real."

To gain access, the malware poses as a Google Services Framework' asking users to install it with administrative privileges enabled. It then disables the uninstall option. Of 54 anti-virus systems tested by researchers, only five successfully detected the malware.

Featured Resources

How virtual desktop infrastructure enables digital transformation

Challenges and benefits of VDI

Free download

The Okta digital trust index

Exploring the human edge of trust

Free download

Optimising workload placement in your hybrid cloud

Deliver increased IT agility with the cloud

Free Download

Modernise endpoint protection and leave your legacy challenges behind

The risk of keeping your legacy endpoint security tools

Download now

Recommended

Hackers could use new Wslink malware in highly targeted cyber attacks
malware

Hackers could use new Wslink malware in highly targeted cyber attacks

1 Nov 2021
FBI raids Chinese POS business following cyber attack claims
malware

FBI raids Chinese POS business following cyber attack claims

27 Oct 2021
Malware developers create malformed code signatures to avoid detection
malware

Malware developers create malformed code signatures to avoid detection

24 Sep 2021
New malware uses search engine ads to target pirate gamers
malware

New malware uses search engine ads to target pirate gamers

21 Jul 2021

Most Popular

How to move Microsoft's Windows 11 from a hard drive to an SSD
Microsoft Windows

How to move Microsoft's Windows 11 from a hard drive to an SSD

4 Jan 2022
Synology DiskStation DS2422+ review: A cube of great capacity
network attached storage (NAS)

Synology DiskStation DS2422+ review: A cube of great capacity

10 Jan 2022
Microsoft Exchange servers break thanks to 'Y2K22' bug
email delivery

Microsoft Exchange servers break thanks to 'Y2K22' bug

4 Jan 2022