Android: this dangerous banking malware spies on text messages to pass two-factor authentication

[Chewy_fox]

Cleafy's security researchers warn of the threat posed by the spread of new banking malware in Europe. Called Teabot, this malware is able to read text messages to help cybercriminals pass two-factor authentication and connect to your bank. The malware targets in particular the customers of around sixty banks in Europe. According to the researchers, the malware is ready to take hold in France. It hides in pirate IPTV apps or fake DHL, UPS or BPost apps. 

Credit: Unsplash

Cleafy researchers announce that they have discovered new banking malware that is currently rampant in several European countries. The Teabot malware is currently most prevalent in Spain, Germany, Italy, Belgium and the Netherlands, but researchers say it still appears to be in an active development phase . We also note that it includes six languages, including French . Concretely, once the malware is installed, it interacts with accessibility services to send hackers a live report of what is displayed on the screen.

Teabot also makes it possible to collect the identifiers of around sixty banks established in Europe , as well as to read the single-use double authentication codes received by SMS . An authentication method that all banks on the continent must abandon by 2022 . From there cybercriminals can take control of your bank account without your knowledge and withdraw money from it. Originally, Teabot pretended to be a pirate IPTV application called TeaTV. The malware has since been hiding in fake applications known as “VLC MediaPlayer”, “DHL”, “UPS” or even Bpost.

THE ANDROID TEABOT MALWARE HAS ALREADY BEEN TRANSLATED INTO FRENCH, PLEASE BE CAREFUL ...

The Cleafy researchers explain: “when the malicious application is downloaded to the device, it tries to install itself as an 'Android service' in other words a system service which allows it to perform long-term operations in the background . This functionality is hijacked by Teabot to hide itself, which allows it, once installed, to prevent its detection and therefore to ensure its persistence in the smartphone ” .

The malware requests several dangerous permissions during installation to observe your actions, retrieve window content and perform arbitrary actions . The application in which the malware is hidden is generally not functional. Once the malware is installed, nothing seems to happen and the icon disappears completely from the smartphone - while the program does indeed begin its misdeeds in the background.

Also read:  Android - don't open this SMS, it's hiding dangerous spyware!

As always we strongly recommend that you never download any apps outside of the Play Store . If you accidentally installed this malware, it is strongly recommended that you restore the smartphone to its factory settings and only restore backups prior to the malware installation.

Edited May 21, 2021 by Chewy_fox

[Silent Watcher]

Avoid unnecessary posts such as 'Thank you', 'Welcome', etc. Such posts will be deleted and user will be warned if it happens again. If caught spamming, the following actions are applicable -

• First time - Warning
• Second time - 5000 Points will be deducted
• Third time - Ban for 7 days
• Fourth time - Permanent Ban

If the post helped you, reward the user by reacting to the post like this -