{"id":400897,"date":"2022-01-28T17:50:26","date_gmt":"2022-01-28T14:50:26","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/heres-how-an-android-2fa-app-was-stealing-bank-accounts\/"},"modified":"2022-01-28T17:50:26","modified_gmt":"2022-01-28T14:50:26","slug":"heres-how-an-android-2fa-app-was-stealing-bank-accounts","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/heres-how-an-android-2fa-app-was-stealing-bank-accounts\/","title":{"rendered":"#Here\u2019s How an Android 2FA App Was Stealing Bank Accounts"},"content":{"rendered":"

“#Here\u2019s How an Android 2FA App<\/a> Was Stealing Bank Accounts”<\/strong><\/p>\n

\n
\"A
WAYHOME studio\/Shutterstock.com<\/a><\/span><\/figcaption><\/figure>\n

A fake two-factor authentication app on Android was actually hiding a banking trojan that could steal\u00a0financial data and other personal information. If you\u2019re one of the 10,000 people who downloaded it, you need to get rid of it right now.<\/p>\n

Researchers from Pradeo<\/a> discovered the app, which was aptly named 2FA Authenticator. It installs a trojan called\u00a0Vultur, which has been infecting Android phones for over a year.<\/p>\n

Roxane Suau from Pradeo said, \u201cOur analysis revealed that the dropper automatically installs a malware called Vultur, which targets financial services to steal users\u2019 banking information.\u201d<\/p>\n

Apparently, the app was well-designed to look like a legitimate 2FA tool. According to Pradeo, \u201cIt has been developed to look legitimate and provide a real service. To do so, its developers used the open-source code of the official Aegis authentication application to which they injected malicious code.\u201d<\/p>\n

The malware works in two stages. First, it profiles the user. It collects and sends the user\u2019s application lists and location data, which allows the attackers to target their actions. During this phase, it will disable the keylock and any associated password security and download other third-party apps disguised as updates.<\/p>\n

For stage two,\u00a0the researchers found that the attack is conditioned to the information the app finds on its users. When some conditions are met, the dropper installs Vultur, the malware that primarily targets online banking interfaces to steal credentials and financial information, which is obviously scary.<\/p>\n

This is not a piece of malware to be taken lightly. If you installed this app (which has been removed from Google Play but is still available on some third-party app stores), you need to delete it immedia<\/a>tely. If the app starts relaunching itself when you try to close it, restart your phone and delete it.<\/p>\n

RELATED:<\/strong> How to Securely Shop Online: 8 Tips to Protect Yourself<\/em><\/strong><\/p>\n<\/div>\n