For most of our accounts, be it Bank accounts or social media accounts, we rely on two-factor authentication and OTP (one-time-password), thinking it the most trustable and impenetrable security. But we ought to think again as a new android malware, “Alien” with its remote access threat tool, can steal 2FA codes and OTP as well as sniff notifications.
Discovered by ThreatFabric, the Trojan Alien has been offered as a Malware-as-a-Service (MaaS) making rounds on underground hacking forums. Though this is not the first malware to access OTPs, Cerberus (malware gang with a similar code) has already been there and done that, but Google’s security found a way to detect and clean devices Cerebus. Inspired and evolved from the same code, Alien has yet to be caught by a security server.
With the remote access feature, Alien can seize passwords and login credentials, and grant hackers access to the device to use the stolen passwords. Alien can also perform the following tasks:
- Overlay on another App
- Steal 2FA and OTP
- Read Notifications
- Collect Geo-location data
- Forward Calls
- Install other Apps
- Steal Contacts
- Provide access to the device
- Log Keyboard Input
- Send Messages
This set of activities makes this malware highly dangerous, and the device infected with it utterly transparent to the hacker and to think it is offered as MaaS. The malware deploys TeamViewer, and through it, reads the devise’s screen, notifications, harvest OTPs and other data – giving full reign of your device to the hacker to attempt fraud, steal money, and data.
How is it Spreading?
According to ThreatFabric, the malware is transmitting via phishing emails and third-party applications. Researchers found that Alien was sporting fake logins for 226 android apps, some of them quite popular like Snapchat, Telegram, Facebook, Gmail, WhatsApp, etc. Many of them were banking and e-commerce apps; there’s no surprise there! These banking apps were from Spain, Germany, the US, Italy, France, Poland, Australia, and the UK.
#Malware challenge :— ThreatFabric (@ThreatFabric) February 20, 2020
🤔Try finding the relation between these screenshots…
💡The answer: They represent latest changes in the #Cerberus #Android banking #Trojan, first spotted mid January, still under development pic.twitter.com/QRFdiWYpLe
- Government Issues Notice to Twitter for Information About Hack
- New PIN Verification Bypass Flaw Affects Visa Contactless Payments
- OnePlus Nord First Look Here & Oneplus Nord Design
- Iranian Hacker Group Developed Android Malware to Steal 2FA SMS Codes
- Google Bans 6 Malware-Infected Apps From the Play Store, Uninstall them Right Now