Obviously, the attackers have adapted this method from the ransomware playbook.

So, the human element is now introduced in an Android attack chain. Note, however, that these apps can only be manually updated to have the Trojan code should the attackers desire it. It's a common evasion tactic which gets their malicious app into the Play Store without raising alarms at the door. So, how do these benign apps become fully malicious? The cybercriminals behind them introduce malicious code as updates to the apps-slowly and surely. Knowing that a portion of Android users are aware that the Play Store often gets malware-thus are quite wary about what they download-these apps actually come with the functions they advertised, further alleviating any doubts in users minds about their legitimacy.īut, as users will soon realize, looking and acting (or sounding) like something they are expected to look and act like are only limited to ducks, as these apps begin to show their true intent after they have been installed. The particular malicious apps the ThreatFabric researchers found were disguised to look like apps that an Android user might normally search for, such as QR scanners, PDF scanners, cryptocurrency wallets, and fitness monitors. All these are done without the victim's consent and without them noticing anything until it's too late. They also capable of stealing phone keystrokes, and taking screenshots of what you're seeing on your phone as you use it.

Security researchers have discovered banking Trojan apps on the Google Play Store, and say they have been downloaded by more than 300,000 Android users.Īs you may know, banking Trojans are kitted for stealing banking data like your username and password, and two-factor authentication (2FA) codes that you use to login to your bank account. This post has been updated to include the Malwarebytes detection for these Android apps.

Malwarebytes google play