Two new Android trojans are targeting apps from Indian banks

It seems Android apps from Indian banks are being targeted by malware. According to a blog post by QuickHeal, certain malware detected by the company, targets both social media and banking apps, including those by Indian banks.

The trojans apparently mask themselves using the Adobe Flash Player or Android Update icons. Specifically, the trojan Android.Marcher.C uses the Flash Player icon, while Android.Asacub.T uses the update icon.

When tapped, they ask for specific permissions to be enabled, which allows them to run in the background. However, that alone is not enough for them to steal your data.

Once the permissions are enabled, the apps run in the background to look for other popular apps. It refers to a pre-created database to find apps on your phone that can be used to steal your data. According to QuickHeal, this includes names like WhatsApp, Facebook, Instagram and Twitter.

When it finds such apps, the malware creates hoax notifications that look like they're from friendly apps. These then ask the user for sensitive information like card numbers, passwords and other login information. Upon getting those, the malware sends the data to a malicious server.

Banking apps

While QuickHeal doesn't explicitly mention the names of banking apps that are affected, in another blog post by the company from January this year, it mentioned apps by Axis Bank, IDBI Bank, State Bank of India (SBI), HDFC Bank and more. The company was talking about a different banking related malware at the time, but those seemed to function the same way as the ones found today.

Older versions of Android

(Source: QuickHeal blog)

The company also failed to mention which versions of Android are affected by the malware. From the screenshots on QuickHeal's blog post (posted above), it seems like older versions, like Android Marshmallow, are affected.

That said, Marshmallow and other older Android versions are quite prevalent in the Indian market. In fact, Marshmallow is amongst the most widespread versions of Android on smartphones today, despite multiple new versions of the software since then.

Spokespersons from QuickHeal weren’t immediately available for clarification.