The problem of dangerous and malicious apps on Google Play Store simply refuses to go away. Google has put in strong defence mechanisms, created awareness amongst users, yet bad actors continue to find ways to infect apps. A recent report by cybersecurity firm Threat Fabric, a new banking formal called Sharkbot has infected apps that could affect Android users in many countries.
“This is not the first time that a Sharkbot dropper sneaks into the official Google store, but this time authors did their best to hide the malicious intents of the dropper,” notes a blog post by Threat Fabric. The report says that the malware comes disguised as an app to calculate tax code in Italy targeting Italian users. The app in question is Code Fiscale. “To ensure that the dropper is launched on a real targeted device, the app obtains the SIM country and compares it to “it” (Italy): if not matched, no malicious activity will be performed.
The other app which Sharkbot uses is File Manager. Threat Fabric says the “malware is configured to distribute Sharkbot payload to Italian users only, while the other “File Manager” dropper has Italy and UK in its configuration.”
Another banking trojan doing the rounds is Vultur. “Vultur is an Android banking trojan which specializes in stealing PII from infected devices using its screen-streaming capabilities,” says the report by Threat Fabric. ThreatFabric discovered three new droppers on the Google Play store, ranging from 1,000 to 100,000 installations.
According to Threat Fabric, the Vultur trojan has been very active and successful in the last few months, reaching more than 100,000 potential fraud victims. “Based on our research and investigation, in addition to cryptowallets which have always been in the target list, the largest campaign we observed focused on UK and Netherlands, while the two smaller and more recent ones switched to Germany, France, and Italy.”
The five apps that Android users in a few countries may have to delete are:
“This is not the first time that a Sharkbot dropper sneaks into the official Google store, but this time authors did their best to hide the malicious intents of the dropper,” notes a blog post by Threat Fabric. The report says that the malware comes disguised as an app to calculate tax code in Italy targeting Italian users. The app in question is Code Fiscale. “To ensure that the dropper is launched on a real targeted device, the app obtains the SIM country and compares it to “it” (Italy): if not matched, no malicious activity will be performed.
The other app which Sharkbot uses is File Manager. Threat Fabric says the “malware is configured to distribute Sharkbot payload to Italian users only, while the other “File Manager” dropper has Italy and UK in its configuration.”
Another banking trojan doing the rounds is Vultur. “Vultur is an Android banking trojan which specializes in stealing PII from infected devices using its screen-streaming capabilities,” says the report by Threat Fabric. ThreatFabric discovered three new droppers on the Google Play store, ranging from 1,000 to 100,000 installations.
According to Threat Fabric, the Vultur trojan has been very active and successful in the last few months, reaching more than 100,000 potential fraud victims. “Based on our research and investigation, in addition to cryptowallets which have always been in the target list, the largest campaign we observed focused on UK and Netherlands, while the two smaller and more recent ones switched to Germany, France, and Italy.”
The five apps that Android users in a few countries may have to delete are:
- Recover Audio, Images & Videos
- Codice Fiscale 2022
- Zetter Authentication
- File Manager Small, Lite
- My Finances Tracker
For all the latest Technology News Click Here
For the latest news and updates, follow us on Google News.
Denial of responsibility! TechNewsBoy.com is an automatic aggregator around the global media. All the content are available free on Internet. We have just arranged it in one platform for educational purpose only. In each content, the hyperlink to the primary source is specified. All trademarks belong to their rightful owners, all materials to their authors. If you are the owner of the content and do not want us to publish your materials on our website, please contact us by email – abuse@technewsboy.com. The content will be deleted within 24 hours.