Trojan targets major Australian bank apps

Millions of Australian banking customers are at risk of falling victim to a mobile banking Trojan capable of stealing login details from the nation's major banks.

The Android Trojan campaign targets customers of banks including Westpac, ANZ, Commonwealth Bank, NAB, St George Bank and Bendigo Bank according to ESET Australia, which discovered the campaign.

The Trojan is capable of mimicking the login screens of 20 mobile banking apps from Australia, New Zealand and Turkey, as well as PayPal, Skype, eBay and several Google services.

It is designed to steal login credentials and also has the ability to intercept SMS communications to bypass SMS-based two-factor authentication.

The Trojan masquerades as a Flash Player app with a legitimate-looking icon and is available on services registered earlier this year.

After downloading and installing the malicious app, the user is prompted to grant the app administrator rights.

On installation, the app is designed to scan for a list of 49 target apps — not all of which are currently directly attacked — and activate if one is found. The malware then manifests as an overlay appearing over the launched application.

This overlay functions as a lock screen that can't be closed unless the user submits login credentials. These credentials are then sent to a remote server and the overlay closes. The malware also attempts to obtain Google account credentials.

Removing the malware requires the user to deactivate administrative privileges — which the Trojan is capable of circumventing by launching an overlay preventing the user for confirming the command — or booting into safe mode.

The full list of banks targeted by the Trojan is: Westpac, Bendigo Bank, Commonwealth Bank, St George Bank, National Australia Bank, Bankwest, Me Bank, ANZ Bank, ASB Bank, Bank of New Zealand, Kiwibank, Wells Fargo, Halkbank, Yapı Kredi Bank, VakıfBank, Garanti Bank, Akbank, Finansbank, Türkiye İş Bankası and Ziraat Bankası.

Image courtesy of Intel Free Press under CC