226 apps may face danger from Alien malware, a new strain of Android malware
By MYBRANDBOOK
Security researchers have discovered and analyzed a new strain of Android malware that comes with a wide array of features allowing it to steal credentials from 226 applications.
Alien, a new Trojan has been active since the start of the year and has been offered as a Malware-as-a-Service (MaaS) offering on underground hacking forums.
In a report shared this week, security researchers from ThreatFabric, an omnichannel solution to data malware etc; dug deep into forum posts and Alien samples to understand the malware's evolution, tricks, and features.
According to researchers, Alien is not truly a new piece of code but was actually based on the source code of a rival malware gang named Cerberus.
Cerberus, while an active MaaS last year, fizzled out this year, with its owner trying to sell its codebase and customer base, before eventually leaking it for free.
Digital solution portal, ThreatFabric says Cerberus died out because Google's security team found a way to detect and clean infected devices. But even if Alien was based on an older Cerberus version, Alien doesn't seem to have this problem and its MaaS stepped in to fill the void left by Cerberus' demise.
And researchers say that Alien is even more advanced than Cerberus, a reputable and dangerous trojan in its own right. ThreatFabric says Alien is part of a new generation of Android banking trojans that have also integrated remote-access features into their codebases.
This makes Alien a dangerous concoction to get infected with. Not only can Alien show fake login screens and collect passwords for various apps and services, but it can also grant the hackers access to devices to use said credentials or even perform other actions.
That's quite an impressive array of features. ThreatFabric says these are mostly used for fraud-related operations, as most Android trojans tend to be these days, with the hackers targeting online accounts, searching for money.
During its analysis, researchers said they found that Alien had support for showing fake login pages for 226 other Android applications
However, Alien targeted other apps as well, such as email, social, instant messaging, and cryptocurrency apps (i.e., Gmail, Facebook, Telegram, Twitter, Snapchat, WhatsApp, etc.).
Most of the banking apps targeted by Alien developers were for financial institutions based mostly in Spain, Turkey, Germany, the US, Italy, France, Poland, Australia, and the UK.
ThreatFabric didn't include details about how Alien makes its way onto users' devices, primarily because this varies based on how the Alien MaaS customers (other criminal groups) chose to distribute it.
"A lot of it seems distributed via phishing sites, for example malicious page tricking the victims into downloading fake software updates or fake Corona apps (still a common trick at the moment)," Gaetan van Diemen, a malware analyst at ThreatFabric said
"Another method observed to be used is the SMS, once they infect a device they collect the contact list which they then reuse for further spreading of their malware campaign," he added.
Some malicious apps make it on the Play Store, once in a while, but most of the time, they're distributed through other channels, van Diemen said.
All of these shady Alien-tainted apps can be easily be spotted as they often require users to grant them access to an admin user or to the Accessibility service.
As self-evident of an advice "don't install apps from shady sites and grant them admin rights" might sound, not all Android users are technical enough to understand it, and many users will download and install apps from any location, and then just click through all the prompts during installations.
This is how malware operates in general, targeting non-technical users, and not the "experts." And there are many of these non-technical users around, hence why Android malware is big business these days on hacking forums.
Happiest Minds brings in an innovative GenAI chatbot
Happiest Minds Technologies has announced the new GenAI chatbot - ‘hAPPI...
Government mandates encryption for CCTV cameras to ensure netw
In the wake of issuing an internal advisory on securing CCTV cameras at g...
TRAI recommends allowing only Indian entities to participate i
The Telecom Regulatory Authority of India (TRAI) has recommended that onl...
Galaxy AI is available on more devices with Samsung One UI 6.1
Samsung has expanded the range of smartphones to which One UI 6.1 and Gala...
SAMSUNG INDIA ELECTRONICS PVT. LTD.
DELL TECHNOLOGIES INDIA PVT. LTD.
ATRIE TECHNOLOGY PVT. LTD.
TP-LINK INDIA PVT LTD.
Technology Icons Of India 2023: Bharat Goenka
Bharat Goenka is the Managing Director of Tally Solutions. He is well ...
Technology Icons Of India 2023: C P Gurnani
CP Gurnani (popularly known as ‘CP’ within his peer group), is the...
Technology Icons Of India 2023: Dr. P D Vaghela
Dr PD Vaghela serves as the Chairperson of Telecommunications Regulato...
C-DOT enabling India in indigenous design, development and production of telecom technologies
An autonomous telecom R&D centre of Government of India, Center of Dev...
TCIL continues to strengthen India with its technology expertise
TCIL undertakes consultancy & turnkey projects in the field of Telecom...
BEL leveraging next generation technologies to keep the country ahead in Defence space
Bharat Electronics Limited (BEL) is a Navratna PSU under the Ministry ...
SAVEX TECHNOLOGIES PVT. LTD.
Savex Technologies is the 3rd largest Information & Communication Tec...
ACCERON INFOSOL PVT. LTD.
It is a leading value added distributor in the IT security space and h...
TECHNOBIND SOLUTIONS PVT. LTD.
TechnoBind’s business model is focused on identifying and partnering...