Best printers for Home

Best Mixer Grinder

Best wired Earphones

Best 43 Inch TV in India

Best Wi Fi Routers

Best Home Theatre in India

Smart Watch under 5000

Best Laptops for Education

Best Laptop for Students

<ul><li>A total of 12 apps with Android banking trojans were discovered in the Google Play Store.</li><li>These apps are capable of stealing banking information and wiping out the victim’s bank account.</li><li>The apps were distributed in a span of four months and downloaded 300,000 times.</li></ul>Google has been improving Play Store’s security but there are still some malware infused apps that manage to sneak inside. Researchers have now discovered a total of 12 apps in the <a href="https://www.businessinsider.in/tech/apps/news/here-are-the-winners-of-google-plays-best-of-2021-in-india/articleshow/87997438.cms">Play Store</a> that were used to steal people’s bank account details, and these apps were downloaded 300,000 times. These apps were<a href="https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html"> posing</a> as QR code scanners, PDF scanners, and even cryptocurrency wallets, according to researchers at ThreatFabric. The apps belonged to four different <keyword id="1019130" type="General" weightage="20" keywordseo="android-malware" source="Orion">Android malware</keyword> versions, and were designed to steal people’s online banking passwords as well as two-factor authentication codes. The malware even captured keystrokes and could take screenshots of users’ phones. So how did the apps bypass Google’s security check? These apps were first distributed as a legitimate app with no malware and worked as they were advertised which made users think there’s nothing wrong here. The apps also had positive reviews in the Google Play Store which would make them look more legitimate. Users were then asked to install software updates from third-party sources for additional features. Through these updates, a very advanced <keyword id="8632255" type="General" weightage="20" keywordseo="android-banking-trojan" source="Orion">Android banking trojan</keyword> ‘Anatsa’ would be installed in the victims’ phones. This Android trojan is capable of giving hackers remote access to a victim’s phone and wiping out one’s bank account by transferring all the money to their account. In addition to Anatsa, these apps also had other Android malware including Alien, Hydra and Ermac. Among the kind of apps that these malware were injected into, the most popular were scanning apps, a crypto tracking app and workout apps. These apps with four large Android malware families were spread in a span of only four months, and were downloaded 300,000 times. ThreatFabric also highlighted how this is actually a small malicious footprint, and this is due to the new Google Play restrictions that puts limitations on app permissions such as Accessibility Service. This was one of the commonly used methods of installing malware on phones but hackers are now resorting to download updates after the app is installed. SEE ALSO: <a href="https://www.businessinsider.in/tech/apps/news/here-are-the-winners-of-google-plays-best-of-2021-in-india/articleshow/87997438.cms" data-type="tilCustomLink">Google Play’s Best of 2021 India Awards: BGMI, Garena Free Fire MAX, Bitclass and Clubhouse top the ranks this year</a> <a href="https://www.businessinsider.in/tech/news/valorant-mobile-gameplay-release-date-and-what-to-expect/articleshow/87974099.cms" data-type="tilCustomLink">Valorant Mobile: Gameplay, release date and what to expect</a>

Android apps that steal banking details were downloaded 300,000 times in just 4 months

<ul><li>ThreatFabric has discovered a new Android banking trojan, Vultur.</li><li>Vultur is more advanced than other Android banking trojans as it uses screen recording to steal login credentials.</li><li>This <keyword id="54201" type="PERSON" weightage="20" keywordseo="Malware">malware</keyword> has been used to target banking applications and crypto wallets as well.</li></ul>Researchers have discovered a new Android malware that records everything happening on your phone. This Android banking trojan dubbed ‘Vultur’ manages to easily get hold of your login credentials through screen recording and keylogging, according to security firm ThreatFabric. The <a href="https://www.threatfabric.com/blogs/vultur-v-for-vnc.html">Vultur malware</a> is believed to be installed on Android phones through a dropper framework called “Brundilha” which takes the form of fitness apps and 2FA authenticators on the Google Play Store. According to ThreatFabric, Vultur is the first Android banking trojan it discovered that uses both screen recording and keylogging as its main strategy to get access to a user’s login credentials. Other Android banking trojans go for the usual process of the HTML overlay strategy that takes more time and effort to steal sensitive data. The Vultur malware was found in at least two dropper apps with one having more than 5,000 installations on the Play Store. ThreatFabric estimates the number of potential victims to be in the thousands. This malware mostly targeted banking institutions in Italy, Australia and Spain. Crypto wallets were also targeted, it added. How Vultur works Vultur relies on Accessibility Services to operate on Android smartphones. It uses VNC (Virtual Network Computing), a software used to remotely control another computer, to screen record everything that happens on the victim’s phone. It can even detect when the victim is using an app that is from the list of targeted apps so that it can initiate the screen recording process. ThreatFabric noted that when the screen recording is going on, the notification panel will show “Projection Guard” under the casting icon. How Vultur is different from other Android banking trojans The approach Vultur uses to harvest login credentials is different from other Android banking trojans. In most cases, the regular Android banking trojan tricks victims into entering their credentials in what they think is an authentic banking app and then giving access to the attackers. Vultur, on the other hand, uses screen recording thereby easily gaining access to the login credentials without having to use any other tricks. The discovery of this malware showed that Android banking trojans have become far more advanced, and it is now easier for attackers to get access to login credentials. ThreatFabric wants that mobile <keyword id="2023235" type="PERSON" weightage="20" keywordseo="Banking-malware">banking malware</keyword> will only increase in the future, and get more sophisticated as well. SEE ALSO: <a href="https://www.businessinsider.in/tech/apps/news/gmail-blocks-more-than-100-million-phishing-attempts-google-play-scans-100-apps-for-malware-says-google/articleshow/83361472.cms" data-type="tilCustomLink">Gmail blocks more than 100 million phishing attempts, Google Play scans 100 apps for malware everyday, says Google</a> <a href="https://www.businessinsider.in/tech/apps/news/photo-editing-and-app-lock-features-android-apps-caught-stealing-users-facebook-passwords/articleshow/84136996.cms" data-type="tilCustomLink">Android apps with over 5.8 million downloads caught stealing users’ Facebook passwords</a>

This new Android banking malware can screen record everything on your phone

<ul><li>‘<keyword id="11829148" type="UNKNOWN" weightage="20" keywordseo="flytrap">FlyTrap</keyword>’ <keyword id="10959184" type="UNKNOWN" weightage="20" keywordseo="Android-trojan">Android trojan</keyword> managed to get access to <keyword id="645406" type="PERSON" weightage="20" keywordseo="User-data">user data</keyword> through social media hijacking, third-party app stores and sideloading apps.</li><li>It is capable of collecting information like Facebook ID, location, email address, IP and address.</li><li>The malware posed as apps offering coupon codes for popular services, and also as voting apps.</li></ul>A new Android <keyword id="284120" type="COMPANY" weightage="20" keywordseo="Trojan">trojan</keyword> has been lurking around since March this year specifically targeting Facebook accounts. Discovered by cybersecurity firm<a href="https://blog.zimperium.com/flytrap-android-malware-compromises-thousands-of-facebook-accounts/"> Zimperium</a>, the Android trojan has been dubbed ‘FlyTrap’, and it has so far affected over 10,000 victims across 144 countries including India, and it is said to have been operated by hackers from Vietnam. The FlyTrap <a href="https://www.businessinsider.in/tech/news/vultur-android-banking-malware-can-screen-record-everything-on-your-phone/articleshow/85002118.cms" data-type="tilCustomLink">malware</a> posed as apps offering coupon codes and voting apps for the best football team or player. These malicious apps were available on the Google Play Store and third-party app stores as well. The first part of this hacking process is engagement. Users are offered coupons for popular apps like Netflix, and Google Ads coupons as well. The voting apps were about the recent Euro 2020 tournament asking users to choose their favourite team or player, and also whether they plan to watch the match. Once the engagement part is over, users are shown their Facebook login page and asked to enter their credentials if they want to finish casting their vote or get the coupon code. After users finish this part too they’re given the coupon code but the page instead claims that the coupon code has expired. “Just like any user manipulation, the high-quality graphics and official-looking login screens are common tactics to have users take action that could reveal sensitive information. In this case, while the user is logging into their official account, the FlyTrap Trojan is hijacking the session information for malicious intent,” Zimperium said in a blog post. The Android trojan is capable of accessing users’ Facebook ID, location, email address, IP address, and cookie and tokens associated with their Facebook account. Hackers can use the Facebook accounts to further spread malware via messages, and also create disinformation campaigns through the user’s geolocation details. The findings of this Android trojan were reported to Google and the malicious apps were removed from the Play Store. But Zimperium warns that some of these apps are still available via third-party stores. SEE ALSO: <a href="https://www.businessinsider.in/tech/news/vultur-android-banking-malware-can-screen-record-everything-on-your-phone/articleshow/85002118.cms" data-type="tilCustomLink">This new Android banking malware can screen record everything on your phone</a> <a href="https://www.businessinsider.in/tech/news/amazons-kindle-could-have-been-easily-hacked-through-malicious-e-books/articleshow/85173995.cms" data-type="tilCustomLink">Amazon’s Kindle e-readers could be prone to hacking through malicious e-books</a>

A new Android trojan called ‘FlyTrap’ is hijacking social media to access user data

Ranked sixth, India was one of the top 10 countries with the largest share of users attacked by <keyword id="955297" type="ORGANIZATION" weightage="20" keywordseo="mobile-malware">mobile malware</keyword> in the second quarter of this year, said a new report by cybersecurity company Kaspersky on Wednesday. The top three countries hit by mobile <keyword id="54201" type="PERSON" weightage="20" keywordseo="Malware">malware</keyword> attacks remained unchanged from the previous quarter -- Iran followed by Algeria and Bangladesh. The report revealed a drastic increase in the number of mobile malware threats detected in the second quarter of the year when compared to Q1. In Q2, Kaspersky detected 1,245,894 malicious installers, an increase of 93,232 over the previous quarter. "As the mobile and Internet consumption goes up, especially in countries like India and other South Asian regions, it can be predicted that cybercriminals too would shift their focus towards increasing threat actors for smartphones to increase their financial gains," Dipesh Kaura, General Manager for South Asia, Kaspersky, said in a statement. "Some of the most popular threat actors include Adware, banking &amp; SMS trojans as well as stalkerware, all these are greatly used by the cybercriminals to earn huge money by targeting smartphone users, and even stealing their important data to later sell it on the dark web or underground market." Among the threats detected, adware topped the list with 48 per cent, a decrease of one percentage point from the previous quarter. RiskTool-type potentially unwanted software ranked second among all detected threat classes. SMS trojans hold third place among all detected threats, said the report, adding that Fakeinst and Opfake were the largest of the detected families of SMS trojans. During the reporting period, Kaspersky detected 38,951 mobile banking trojan installer packages. It also detected 3,805 installation packages for mobile Trojan ransomware in Q2 2020, which is 534 fewer than last quarter. "Consumers today need to understand the importance of having a basic anti-virus or Internet security solution installed on their devices to keep their data safe," said Kaura.

India now sixth worst affected country by mobile malware - adware, banking trojans and stalkerware biggest threats

Cyber security researchers have found a <keyword id="9994130" type="UNKNOWN" weightage="20" keywordseo="new-trojan-malware">new Trojan malware</keyword> named Alien that can steal credentials from 226 Android apps in several countries including in India. Alien targeted other apps as well like Gmail, Facebook, Telegram, Twitter, Snapchat and WhatsApp. Most targets are banking apps, but Alien can also show phishing pages for social, instant messaging, and cryptocurrency apps, reports ZDNet. The <keyword id="9994132" type="UNKNOWN" weightage="20" keywordseo="alien-malware">Alien malware</keyword> is a rented banking Trojan which offers more than the average capabilities of Android banking Trojans. According to security researchers from ThreatFabric, it has common capabilities such as overlay attacks, control and steal SMS messages and harvest the contact list. The malware can leverage its keylogger for any use and, therefore, broaden the attack scope further than its target list. "It also offers the possibility to install, start and remove applications from the infected device". Most importantly, it offers a notifications sniffer, allowing it to get the content of all notifications on the infected device, and a RAT (Remote Access Trojan) feature (by abusing the TeamViewer application), meaning that the threat actors can perform the fraud from the victim's device. According to cyber security researchers, Alien is not a new piece of code but based on the source code of a rival malware named Cerberus which was an active malware-as-a-service (MaaS) last year. "We also notice an interest from actors in recording and stealing more information surrounding the victim. How that information will be used or monetized can vary, it is just a matter of time before actors find out about the value of such information," the researchers noted in a blog post. The last quarter of 2020 will probably come with some additional changes to the threat landscape, especially since the source code of the Cerberus Trojan has been made publicly available. In the coming months, we can definitively expect some new malware families, based on Cerberus, to emerge, the researchers added. "We strongly recommend all financial institutions to understand their current and future threat exposure and consequently implement the relevant detection and control mechanisms". SEE ALSO: <a href="https://www.businessinsider.in/finance/banks/news/hdfc-bank-and-sbi-customers-are-facing-upi-payment-glitches/articleshow/78293815.cms">HDFC Bank and SBI customers are facing UPI payment glitches</a> <a href="https://www.businessinsider.in/defense/news/drdo-waives-performance-security-for-development-contracts-as-an-incentive-for-the-private-sector/articleshow/78295788.cms">DRDO waives ‘performance security’ for development contracts as an incentive for the private sector</a> <a href="https://www.businessinsider.in/science/space/news/the-first-ever-supermassive-black-hole-to-be-captured-on-camera-has-a-wobbly-shadow/articleshow/78290040.cms">The first-ever supermassive black hole to be captured on camera has a wobbly shadow</a>

Google, Facebook, Twitter, WhatsApp and 222 other Android apps were targeted by a new Trojan malware found stealing user credentials

It seems <keyword id="6355645" type="UNKNOWN" weightage="20" keywordseo="Android">Android</keyword> apps from Indian banks are being targeted by <keyword id="54201" type="PERSON" weightage="20" keywordseo="Malware">malware</keyword>. According to a <a href="https://blogs.quickheal.com/alert-quick-heal-detects-banking-trojan-malware-seeking-financial-data-using-popular-social-media-banking-apps/">blog post</a> by QuickHeal, certain malware detected by the company, targets both social media and banking apps, including those by Indian banks. The <keyword id="162437" type="ORGANIZATION" weightage="20" keywordseo="Trojans">trojans</keyword> apparently mask themselves using the <keyword id="780514" type="PERSON" weightage="20" keywordseo="Adobe-Flash-Player">Adobe Flash Player</keyword> or Android Update icons. Specifically, the trojan Android.Marcher.C uses the Flash Player icon, while Android.Asacub.T uses the update icon. When tapped, they ask for specific permissions to be enabled, which allows them to run in the background. However, that alone is not enough for them to steal your data. Once the permissions are enabled, the apps run in the background to look for other popular apps. It refers to a pre-created database to find apps on your phone that can be used to steal your data. According to QuickHeal, this includes names like WhatsApp, Facebook, <keyword id="819905" type="COMPANY" weightage="20" keywordseo="Instagram">Instagram</keyword> and Twitter. When it finds such apps, the malware creates hoax notifications that look like they're from friendly apps. These then ask the user for sensitive information like card numbers, passwords and other login information. Upon getting those, the malware sends the data to a malicious server. Banking apps While QuickHeal doesn't explicitly mention the names of banking apps that are affected, in another <a href="https://blogs.quickheal.com/android-banking-trojan-targets-232-apps-including-indian-banks/">blog post</a> by the company from January this year, it mentioned apps by Axis Bank, IDBI Bank, State Bank of <keyword id="3658" type="LOCATION" weightage="20" keywordseo="India">India</keyword> (SBI), HDFC Bank and more. The company was talking about a different banking related malware at the time, but those seemed to function the same way as the ones found today. Older versions of Android 
	
	
	
	
	<div type="image" title="screenshots" msid="64602734" hostid="261"></div>











(Source: <a href="https://blogs.quickheal.com/alert-quick-heal-detects-banking-trojan-malware-seeking-financial-data-using-popular-social-media-banking-apps/" data-type="tilCustomLink">QuickHeal blog</a>) The company also failed to mention which versions of Android are affected by the malware. From the screenshots on QuickHeal's blog post (posted above), it seems like older versions, like Android Marshmallow, are affected. That said, Marshmallow and other older Android versions are quite prevalent in the Indian market. In fact, Marshmallow is amongst the most widespread versions of Android on smartphones today, despite multiple new versions of the software since then. Spokespersons from QuickHeal weren’t immediately available for clarification.

Two new Android trojans are targeting apps from Indian banks

Cybersecurity firm <keyword id="412137" type="PERSON" weightage="20" keywordseo="Kaspersky">Kaspersky</keyword> has detected a new version of the <keyword id="8794922" type="UNKNOWN" weightage="20" keywordseo="Ginp-banking-trojan">Ginp banking Trojan</keyword>, and it is more powerful than it was before. The <keyword id="54201" type="PERSON" weightage="20" keywordseo="Malware">malware</keyword> was first detected in October last year and now, a new version has been spotted. What is a banking trojan? A banking trojan is a program that tries to obtain confidential information about users and clients using banking and payment systems. The trojan often intercept OTPs from banks to make a payment without the victim noticing. What is Ginp? Ginp is a banking trojan and when it was first spotted, it used to send the victim’s contacts to its creators, stole card data and intercepted text messages. Now, it has started sending users messages and push notifications to get the user to open banking apps. The notifications are designed in a way that the user expects to see a form for entering card details. It then overlays the app with a phishing window to steal user data. For this, it uses the phone’s accessibility functions that allows it to see the screen and tap buttons or links. As per the <a href="https://www.kaspersky.com/blog/ginp-mobile-banking-trojan/32478/">report</a>, in one such instance, a user was sent a notification from the Play Store. The notification said – “We are missing your credit or debit card details. Please use the Play Store app to add them securely.” When the user clicked on the notification, a form to enter the card details was shown to him. However, this form was not sent by Google Play and any information entered here would directly go to the malware creators. Similarly, fake SMSes from banks are also being sent to users, warning them that suspicious activity has been detected on their accounts. The trojan is able to create fake SMS with any text from any sender. How to protect yourself from banking trojans? <ul><li>Do not click on links in text messages if the message seems suspicious to you. </li><li>Download apps only from the Play Store and do not install apps from unknown sources. </li><li>Do not give accessibility permission to any app that does not require it. </li><li>Be careful while giving apps the permission to access SMS. </li><li>Do not click on suspicious push notifications. </li></ul>See also: <a href="https://www.businessinsider.in/tech/news/new-android-flaw-bluefrag-exploits-your-phones-bluetooth-to-send-malware/articleshow/74060573.cms">New Android flaw Bluefrag exploits your phone's Bluetooth to send malware</a> <a href="https://www.businessinsider.in/scammers-whatsapp-stealing-money-how-to-protect/articleshow/72976604.cms">Scammers are now using WhatsApp to steal money - here’s how you can protect yourself</a> <a href="https://www.businessinsider.in/tech/mobile/news/new-malware-on-the-rampage-might-target-jio-users-next/articleshow/71819198.cms">New malware on the rampage might target Jio users — and uninstalling it won’t help</a>

A malware is sending fake SMS to steal your banking details – Here’s how to protect yourself

<ul><li>The "attack campaign" of this 'Trojan' category virus is active globally, said the Computer Emergency Response Team of India (CERT-In), the national technology arm to combat cyberattacks and guard Indian cyber space. </li><li>"It is reported that a new Android <keyword id="54201" type="PERSON" weightage="20" keywordseo="Malware">malware</keyword> strain dubbed 'BlackRock' equipped with datastealing capabilities is attacking a wide range of Android applications. </li><li>The "noteworthy feature" of this malware is that its target list contains 337 applications including banking and financial applications, and also non-financial and well-known commonly used brand name apps on an <keyword id="747689" type="PERSON" weightage="20" keywordseo="Android-device">Android device</keyword> that focus on social, communication, networking and dating platforms, it said. </li></ul>The country's cyber security agency has issued an alert against an Android malware, dubbed 'BlackRock', that has the potential to "steal" banking and other confidential data of a user. It can extract credentials and credit card information from over 300 apps such as email, e-commerce apps, social media apps, besides banking and financial apps, the CERT-In said in an advisory. The "attack campaign" of this 'Trojan' category virus is active globally, said the Computer Emergency Response Team of India (CERT-In), the national technology arm to combat cyberattacks and guard Indian cyber space. "It is reported that a new Android malware strain dubbed 'BlackRock' equipped with datastealing capabilities is attacking a wide range of Android applications. "The malware is developed using the source code of Xerxes banking malware which itself is a variant of LokiBot Android Trojan," the advisory said. The "noteworthy feature" of this malware is that its target list contains 337 applications including banking and financial applications, and also non-financial and well-known commonly used brand name apps on an Android device that focus on social, communication, networking and dating platforms, it said. "It can steal credentials and credit card information from over 300 plus apps like email clients, e-commerce apps, virtual currency, messaging or social media apps, entertainment apps, banking and financial apps etc," the advisory said. The advisory described the infection activity of the virus. "When the malware is launched on the victim's device, it hides its icon from <keyword id="3260481" type="COMPANY" weightage="20" keywordseo="app-drawer">app drawer</keyword> and then masquerades itself as a fake <keyword id="6355629" type="COMPANY" weightage="20" keywordseo="google">Google</keyword> update to request accessibility service privileges." "Once this privilege is granted, it becomes free to grant itself additional permissions allowing it to function further without interacting with user," it said. Threat operators can issue a number of commands for various operations such as logging keystrokes, spamming the victims' contact lists with text messages, setting the malware as the default SMS manager, pushing system notifications to the C2 (command and control) server, locking the victim in the device home screen and steal and hide notifications, send spam and steal SMS messages and many more such activities, the advisory said. The virus is deadly as it has the capability to "deflect" majority of anti-virus applications. "Another feature of this Android Trojan is making use of "Android work profiles" to control the compromised device without requiring complete admin rights and instead creating and attributing its own managed profile to gain admin privileges," it said. The federal cyber security agency suggested some counter-measures: do not download and install applications from untrusted sources and use reputed application market only; always review the app details, number of downloads, user reviews and check 'additional information' section before downloading an app from play store, use device encryption or encrypt external SD card; avoid using unsecured, unknown Wi-Fi networks among others. Also, when it comes to downloading banking apps one should use the official and verified version and users should make sure they have a strong AI-powered mobile antivirus installed to detect and block this kind of tricky malware, the advisory said. SEE ALSO: <a href="https://www.businessinsider.in/business/news/reliance-retail-contribution-to-ril-as-mukesh-ambani-preps-for-fundraising-will-be-key/articleshow/77240105.cms">Reliance Retail’s contribution to RIL as Mukesh Ambani preps for fundraising will be key⁠— aside from the oil shock</a> <a href="https://www.businessinsider.in/education/news/india-revamps-its-education-policy-after-34-years-scraps-mphil-proposes-vocational-courses-from-class-6-ug-colleges-to-become-autonomous/articleshow/77241851.cms">India revamps its education policy after 34 years — scraps MPhil, proposes vocational courses from class 6, UG colleges to become autonomous</a> <a href="https://www.businessinsider.in/education/news/india-revamps-its-education-policy-after-34-years-scraps-mphil-proposes-vocational-courses-from-class-6-ug-colleges-to-become-autonomous/articleshow/77241851.cms">India’s Rafale fighter jets — Here’s how it stacks up against Chinese J-20</a>

Android malware 'BlackRock' prowling in cyber space, may steal banking data: Advisory

<ul><li>Octo, a subset of ExoCompact malware has been discovered by ThreatFabric.</li><li>The malware can take control of your device remotely.</li><li>According to ThreatFabric, Octo is actively being sold to hackers on the darknet forums.</li></ul>If you are an Android user then you should be careful of a <keyword id="1806373" type="General" weightage="20" keywordseo="new-malware" source="Orion">new malware</keyword> named Octo. It is designed to take control of your smartphone remotely, compromising important information including banking details. Octo has been identified by <a href="https://www.threatfabric.com/blogs/octo-new-odf-banking-trojan.html">ThreatFabric</a> and they also shared a report that how it is being spread through darknet forums. The detailed report also shed some light on its existence. It evolved from ExoCompact malware which is based on Exo trojan. Octo has advanced remote access capabilities powered by a live streaming module that is updated every second. Once an Android smartphone is compromised with Octo, it uses the black screen to hide remote operations. It sets screen brightness to zero and disables all the notifications by activating no interruption mode. Octo will also allow attackers to see what you’re typing on the keyboard including passwords and bank details. Octo also features a list of commands like blocked notifications, temporary screen lock, SMS interception, remote access and even sending SMS to a specific number. According to the report, Octo is being sold on online forums by using the alias ‘goodluck’ or ‘architect’. List of known Android apps containing the Octo malware <ol><li>Pocket Screencaster</li><li>Fast Cleaner 2021</li><li>Pocket Screencaster</li><li>BAWAG PSK Security</li><li>Play Store app install</li></ol>Protect your device from Octo The only possible way to protect your device from Octo and other malicious Android apps is to be careful about what you install. Once malware is on your device then everything is accessible. Limit the number of apps you install and only install apps from trusted sources. Also, make sure Play Protect is activated on your device. SEE ALSO: <a href="https://www.businessinsider.in/tech/mobile/news/amazon-fab-phones-fest-2022-best-offers-on-mid-range-smartphones/articleshow/90796030.cms">Amazon Fab Phones Fest 2022: best offers on mid-range smartphones</a> <a href="https://www.businessinsider.in/tech/news/whatsapp-likely-to-roll-out-new-drawing-tools-and-media-visibility-features/articleshow/90793240.cms">WhatsApp likely to roll out new drawing tools and media visibility features</a>

This new Android malware sits silently on your phone to remotely take control of your device

A dangerous Android banking malware that steals victim's credentials and SMS messages has been downloaded thousands of times via <keyword id="6369511" type="General" weightage="20" keywordseo="google-play-store" source="Orion">Google Play Store</keyword>, researchers have warned. Called '<keyword id="13305683" type="General" weightage="80" keywordseo="teabot" source="Orion">TeaBot</keyword>,' it is an Android banking trojan that first emerged at the beginning of 2021 designed for stealing victim's text messages. Initially, TeaBot has been distributed through smishing campaigns using a predefined list of lures, such as <keyword id="13305684" type="General" weightage="20" keywordseo="TeaTV" source="Orion">TeaTV</keyword>, VLC Media Player, DHL and UPS and others, according to online fraud management and prevention solution provider Cleafy. "In the last months, we detected a major increase of targets which now count more than 400 applications, including banks, crypto exchanges/wallets and digital insurance, and new countries such as Russia, Hong Kong, and the US," the researchers informed. During the last months, TeaBot has also started supporting new languages, such as Russian, Slovak and Mandarin Chinese, useful for displaying custom messages during the installation phases. On February 21, the Cleafy Threat Intelligence and Incident Response (TIR) team discovered an application published on the official Google Play Store, which was acting as a dropper application delivering TeaBot with a fake update procedure. "The dropper lies behind a common QR Code &amp; Barcode Scanner and it has been downloaded more than 10,000 times. All the reviews display the app as legitimate and well-functioning," the team noted. However, once downloaded, the dropper will request an update immediately through a popup message. Unlike legitimate apps that perform the updates through the official Google Play Store, the dropper application will request to download and install a second application. This application has been detected to be TeaBot. TeaBot, posing as "QR Code Scanner: Add-On", is downloaded from two specific GitHub repositories. Once the users accept to download and execute the fake "update", TeaBot will start its installation process by requesting the 'Accessibility Services' permissions in order to obtain the privileges needed. One of the biggest differences, compared to the samples discovered during May 2021, is the increase of targeted applications which now include home banking applications, insurance applications, crypto wallets and crypto exchanges. "In less than a year, the number of applications targeted by TeaBot have grown more than 500 per cent, going from 60 targets to over 400," the team said. Google Play was yet to comment on the report. SEE ALSO: <a href="https://www.businessinsider.in/tech/news/russia-ukraine-war-anonymous-hackers-launch-cyberwar-against-russia-taking-down-government-websites/articleshow/89817168.cms">Russia-Ukraine war: Anonymous hackers launch cyberwar against Russia taking down government websites</a> <a href="https://www.businessinsider.in/cryptocurrency/news/cybercriminals-are-extorting-huge-sums-of-crypto-in-ransomware-attacks-as-they-go-after-bigger-and-bigger-targets-chainalysis-says/articleshow/89487500.cms">Cybercriminals are extorting huge sums of crypto in ransomware attacks as they go after bigger and bigger targets, Chainalysis says</a> <a href="https://www.businessinsider.in/tech/apps/news/android-apps-that-steal-banking-information-were-downloaded-300000-times/articleshow/88022001.cms">Android apps that steal banking details were downloaded 300,000 times in just 4 months</a>

Thousands of users have downloaded Android malware that steals user's credentials and SMS

<div class="KonaFilter image-container display-table float_right"><div><div class="image on-image">Win McNamee/Getty ImagesEric Schmidt, executive chairman of Google's parent company Alphabet.</div></div></div>Watch out, Android users: Security researchers have discovered a nasty new piece of smartphone malware that targets users of Google's mobile operating system - and it uses Google's popular <keyword id="35666" type="COMPANY" weightage="60" keywordseo="advertising">advertising</keyword> network AdSense to do it.It's a banking "trojan," which is designed to steal its victims' banking details. One way it does this is by creating phishing windows designed to dupe users into entering their details. It can also read and and delete text messages sent to users by their banks.The worrying part is how it makes its way to the victim's phone. <a href="https://securelist.com/blog/incidents/75731/good-morning-android/?utm_source=dlvr.it&amp;utm_medium=twitter">Researchers from security firm Kaspersky found that it is being distributed by AdSense</a> - Google's huge advertising network which is used by countless companies and people to display ads on their websites. Ads that are powered by AdSense appear everywhere from tiny blogs to the websites of international news organisations (Kaspersky researchers saw it appear on RT, the state-owned Russian media company); it's the single biggest ad network in the world.Google did not immediately respond to a request for comment.<div class="KonaFilter image-container display-table float_right"><div><div class="image on-image">KasperskyThe malware downloading itself via a Google AdSense advert on propaganda site Russia Today.</div></div></div>The malware, once installed, hides itself from the list of applications on the phone, making it harder to detect and remove.And, as well as stealing financial data, it also spies on the victim more generally: "Svpeng collects an impressive amount of information from the user's phone - the call history, text and multimedia messages, browser bookmarks and contacts," <a href="https://securelist.com/blog/incidents/75731/good-morning-android/?utm_source=dlvr.it&amp;utm_medium=twitter">Kaspersky researchers wrote in a blog post on Monday</a>.There are ways to avoid being infected. If users have their security settings set so their phone won't run apps from unknown sources, their devices won't be compromised. By default, Android won't run unknown apps - but it is sometimes necessary to change these settings (to install apps from third-party app stores, for example) - putting the phone at risk.The malware appears to be specifically targeting Russian users, as it was designed to create phishing windows for a specific Russian bank. But it's still embarrassing for Google, and fuels the argument often made that online ad-blocking is sometimes necessary as a security measure to protect the user.Ad networks used by media organisations have been caught accidentally delivering malware to readers before. Back in September 2015, for example, researchers found news site <a href="http://www.forbes.com/sites/thomasbrewster/2015/09/22/forbes-website-served-malware/#74866fb73748">Forbes was accidentally delivering malware to users via malicious ads</a>. The issue was subsequently resolved. <div class="margin-top"> <h3>NOW WATCH: <a href="http://www.businessinsider.com/truck-paves-road-faun-fastrack-2016-8">This monster truck paves its own road anywhere</a></h3> <div> <div> <div class="ooyala-video-player" data-video-autoplay="false" data-video-id="d4ODc3NTE693V8rf7t0TRYriiIg2r5GG" data-player-variable="ooyalapopvideo" id="ooyalaplayer_popvideo" style="width:1280px;height:720px"></div> </div> </div> </div>

A nasty Android malware is spreading using Google's online ad network

<div class="KonaFilter image-container display-table float_right"><div><div class="image on-image">AP PicturesAndroid remains the most targeted mobile operating system, but infection numbers are questionable.</div></div></div>Last year, Apple CEO Tim Cook mocked Google at the company's WWDC developers conference, claiming it is the target of 99% of mobile malware.Although this figure might be inflated, new research indicates that Android is the most targeted mobile operating system.Hackers at the gatesAccording to security firm G Data hackers are developing nearly 5,000 new Android malware variants per day, over 50% of which are designed to steal money from their victims. <a href="https://public.gdatasoftware.com/Presse/Publikationen/Malware_Reports/G_DATA_MobileMWR_Q1_2015_US.pdf" title="G Data mobile malware report">G Data revealed the Android figure in its Mobile Malware Report Q1/2015</a>, alongside a wealth of other statistics.Key findings include:<ul><li>G Data discovered an average of 4,900 new Android malware variants per day during the period.</li><li>A total of 440,267 new malware samples were detected during Q1 2015, marking a 6.4 percent increase to 413,871 figure recorded in Q4 2014.</li><li>This means G Data analysts identified a new malware sample every 18 seconds per hour during the period.</li><li>Financially motivated Android malware accounted for 50.3 percent of the newly discovered variants.</li></ul>The paper said the most common type of money making malware targeting Android included banking Trojans, ransomware, and SMS Trojans.A banking Trojan is a form of malware designed to steal victims financial information.Ransomware is a malware type that locks users out of their device and demands payment for returned access.SMS Trojans earn money by covertly making victim smartphones send messages to premium rate numbers owned by the hackers.G Data is one of many security companies to warn the number of malware types targeting Android is increasing.<a href="https://www.pulsesecure.net/lp/mobile-threat-report-2014/" title="2015 mobile threat report">Security firm Pulse Secure reported 97% of all mobile malware is designed to target Android</a> in its own Mobile Threat Report in June.Is the Android malware working and should you be worried?Despite the wealth of malware targeting Android, the G Data report fails to answer one crucial question, is the malware working?For years there has been an ongoing tit for tat debate within the security community about the effectiveness of mobile malware, with many feeling it is still unclear how many of the attacks actually manage to infect devices and cause harm.Google claimed despite the wealth of malware targeting its platform <a href="http://uk.businessinsider.com/google-report-on-android-malware-and-security-2015-4" title="Google just demolished Tim Cook's case against Android">only 1% of devices running Android are actually infected with malware</a> in its April "Android Security 2014 Year in Review." In other words, even though Android is being targeted more than other mobile platforms, the malware isn't actually working. Telecoms giant <a href="http://www.v3.co.uk/v3-uk/news/2403788/hackers-hitting-firms-with-malware-five-times-a-second" title="Hackers hitting firms with malware five times a second">Verizon lent credence to this claim in its Data Breach Investigations Report, when it revealed only 0.3% of mobile devices on its network were infected with malware</a> later in April.It remains unclear how many malware variants G Data detected targeting other mobile platforms, such as iOS, Windows Phone, and BlackBerry OS. Business Insider has reached out to G Data for comment. <div class="margin-top"> <h3>NOW WATCH: <a href="http://www.businessinsider.com/google-maps-no-service-save-offline-2015-6">How to use Google Maps when you have no phone service</a></h3> <div> <div> <div class="ooyala-video-player" data-video-autoplay="false" data-video-id="ZpNHJpdToN1iDxw4TBEp9pQEjOf1aZAz" data-player-variable="ooyalapopvideo" id="ooyalaplayer_popvideo" style="width:1280px;height:720px"></div> </div> </div> </div>

Tim Cook's case against Android security may have just gotten a boost

<keyword id="6383347" type="ORGANIZATION" weightage="60" keywordseo="Kaspersky-Lab">Kaspersky Lab</keyword>, one of the top 4 cyber security solutions providers in the world, has come up with its predictions about <keyword id="45145" type="ORGANIZATION" weightage="100" keywordseo="2014">2014</keyword>. Not surprisingly, much of what it has seen in the crystal ball is connected to the fallout from <keyword id="1702690" type="UNKNOWN" weightage="80" keywordseo="Edward-Snowden">Edward Snowden</keyword>’s revelations. According to Kaspersky experts, cybercriminals will target both end users and businesses this year. Let us first look at how individuals will be affected. 
 
Your privacy: After the <keyword id="6423563" type="UNKNOWN" weightage="40" keywordseo="Snowden">Snowden</keyword> episode in 2013, people are now determined to keep their private life under wraps in spite of the attention from intelligence agencies. That means protecting the information stored on their computers and devices and ensuring that their online behaviour remains confidential. This will lead to greater popularity for VPN services and Tor anonymisers, as well as increased demand for local encryption tools. 
 
Your money: In 2014, cybercriminals will continue to develop tools for stealing cash – directly or indirectly. To plunder pockets directly, fraudsters will further refine their tools, designed to access the bank accounts of mobile device owners (mobile <keyword id="6359049" type="UNKNOWN" weightage="40" keywordseo="phishing">phishing</keyword>, banking Trojans). Mobile botnets will be bought and sold, and will also be used to distribute malicious attachments on behalf of third parties. For indirect thefts, we are likely to see more sophisticated versions of the Trojans that encrypt the data on mobile devices, preventing access to photos, contacts and correspondence until a decryption fee is handed over. Android-based smartphones will undoubtedly be the first targets. 
 
Your Bitcoins: There will be a considerable rise in the number of attacks targeting the Bitcoin users’ wallets, Bitcoin pools and stock exchanges. 
 
How it will affect businesses 
Internet service providers: A number of popular Internet services have already announced the implementation of additional measures to protect user data, for example, encryption of all data transmitted between their own servers. Implementing more sophisticated measures will continue and is likely to become a key factor when users choose between rival web services. 
 
Cloud storage providers: Hackers are targeting Cloud service employees, seeing them as <keyword id="850254" type="UNKNOWN" weightage="40" keywordseo="the-weakest-link">the weakest link</keyword> in the security chain. A successful attack here could hand cybercriminals the keys to huge volumes of data. In addition to data theft, attackers might be interested in deleting or modifying information. In some cases, manipulated misinformation could be worth even more to those who commission the attacks. This is an ongoing trend. 
 
Software developers: The theft of popular product sources (gaming industry, mobile apps developers, etc.,) gives attackers an excellent opportunity to find vulnerabilities in the products and further use them for their own fraudulent purposes. In addition, if cybercriminals have access to the victim’s repositories, they can modify the programme source code and embed backdoors into it. 
 
Rival companies: Snowden’s leaks have demonstrated that one of the goals of cyber espionage between states is to provide economic aid to ‘friendly’ companies. This factor has broken down the ethical barriers which initially restrained businesses from using unconventional methods to compete with their rivals. In the new realities of cyberspace, businesses are contemplating the possibility of conducting this kind of activity for themselves. Companies will employ cyber-mercenaries, organised groups of qualified hackers who can offer bespoke cyber-espionage services. 
 
A fragmented World Wide Web on the cards? 
“The Internet has begun to break up into national segments. Snowden’s revelations have intensified the demand for rules prohibiting the use of foreign services. Individual countries are no longer willing to let a single byte of information out of their networks. These aspirations will grow stronger and legislative restrictions will inevitably transform into technical prohibitions. The next step will most likely be attempts to limit foreign access to data inside a country. As this trend develops further, it may lead at some point to the collapse of the current Internet, which will break into dozens of national networks. The shadowy Darknet will then be the only truly World Wide Web,” says Alexander Gostev, chief security expert of the global research &amp; analysis team. 
 Several countries have adopted or are planning to adopt legislation prohibiting the use of foreign services. In November, Germany announced that all communications between the German authorities would be fully locked within the country. <keyword id="6355226" type="COUNTRY" weightage="40" keywordseo="Brazil">Brazil</keyword> has announced its plans to build an alternative Internet channel, so that it doesn’t have to use the one that goes through Florida in the US. 
 
Altaf Halde is the Managing Director, Kaspersky Lab -South Asia. 
 
Image: Thinkstock

You Searched For "android banking trojan" and got 13 results

Android apps that steal banking details were downloaded 300,000 times in just 4 months

Marcia Sekhose

This new Android banking malware can screen record everything on your phone

Marcia Sekhose

A new Android trojan called ‘FlyTrap’ is hijacking social media to access user data

Marcia Sekhose

India now sixth worst affected country by mobile malware - adware, banking trojans and stalkerware biggest threats

IANS

Google, Facebook, Twitter, WhatsApp and 222 other Android apps were targeted by a new Trojan malware found stealing user credentials

IANS

Two new Android trojans are targeting apps from Indian banks

Prasid Banerjee

A malware is sending fake SMS to steal your banking details – Here’s how to protect yourself

Rounak Jain

Android malware 'BlackRock' prowling in cyber space, may steal banking data: Advisory

PTI

This new Android malware sits silently on your phone to remotely take control of your device

Rahul Verma

Thousands of users have downloaded Android malware that steals user's credentials and SMS

IANS

A nasty Android malware is spreading using Google's online ad network

Rob Price

Tim Cook's case against Android security may have just gotten a boost

Alastair Stevenson

Cyber Security: What’s The Next Big Threat In 2014?

Altaf Halde

Popular Keywords

Buying Guides