BlackRock banking Trojan targets Android apps

Trojan steals login credentials and credit card information and has targeted more than 300 apps

Trojan virus

Researchers at ThreatFabric have released a report detailing their findings on BlackRock, the Android banking Trojan. Discovered in May, BlackRock steals login credentials and credit card information and has targeted 337 financial, communication, dating and social networking apps.

According to ThreatFabric, BlackRock poses as a fake Google Update and requests accessibility privileges. Once the Trojan gets the needed privileges, it grants itself additional permissions so it can function without requiring any further interaction with the device’s user. 

BlackRock can collect device information, perform overlay attacks, act as a keylogger, push system notifications to the C2 server, curb antivirus use and even prevent uninstallation.

Advertisement - Article continues below

ThreatFabric says BlackRock is based on Xerxes banking malware code, which was a strain of the LokiBot Android banking Trojan discovered in 2019. 

LokiBot was observed as rented malware between 2016 and 2017. The Trojan’s source code was later leaked. 

In 2018, MysteryBot, which included upgrades to the LokiBot Trojan so it worked on newer Android devices, was observed to be active. Parasite, MysteryBot’s successor, was also based on LokiBot, though it ultimately disappeared from the threat landscape, and Xeres replaced it in 2019. Fast-forward to May 2020, and BlackRock emerged.

“After investigation, it became clear that this newcomer is derived from the code of the Xerxes banking malware, which itself is a strain of the LokiBot Android banking Trojan. The source code of the Xerxes malware was made public by its author around May 2019, which means that it is accessible to any threat actor,” the report says.

Advertisement
Advertisement - Article continues below

“When source code of malware is leaked or made publicly accessible it is pretty common to see the threat landscape being supplemented with new malware variants or families based on the said code,” the report continued.

Advertisement - Article continues below

Thus far, BlackRock’s targets for credential theft have included the following apps:  

It’s also targeted various banking apps in an effort to steal credentials, including: 

  • Barclays
  • Santander
  • Royal Bank of Scotland
  • Lloyds
  • ING 
  • Wells Fargo. 

To steal credit card information, BlackRock has targeted a wide range of apps, including: 

Featured Resources

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Remote working 2020: Advantages and challenges

Discover how to overcome remote working challenges

Download now

Keep your data available with snapshot technology

Synology’s solution to your data protection problem

Download now

After the lockdown - reinventing the way your business works

Your guide to ensuring business continuity, no matter the crisis

Download now
Advertisement

Recommended

What is a Trojan?
Security

What is a Trojan?

15 Jun 2020
Russia hacked Liam Fox's personal email to steal trade documents
phishing

Russia hacked Liam Fox's personal email to steal trade documents

4 Aug 2020
British teenager charged over Twitter hack
hacking

British teenager charged over Twitter hack

3 Aug 2020
Mid-year report says vulnerabilities up 22% in 2020
hacking

Mid-year report says vulnerabilities up 22% in 2020

30 Jul 2020

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

3 Aug 2020
How to use Chromecast without Wi-Fi
Mobile

How to use Chromecast without Wi-Fi

4 Aug 2020
How do you build a great customer experience?
Sponsored

How do you build a great customer experience?

20 Jul 2020