Subj : This sneaky new Android malware can hide in plain sight - and it'
To   : All
From : TechnologyDaily
Date : Fri Dec 01 2023 13:00:06

This sneaky new Android malware can hide in plain sight - and it's all thanks 
to virtualization

Date:
Fri, 01 Dec 2023 12:45:18 +0000

Description:
Malware running in a sandbox escapes all security checks and is able to steal 
banking credentials and money.

FULL STORY
======================================================================

A sneaky new Android malware was recently discovered, using virtualization to 
avoid detection and make serious money for its operators. 

It is called FjordPhantom and its goal is to steal money from peoples bank 
accounts. The malware was discovered by cybersecurity researchers Promon, who 
say it mostly targets users in Indonesia, Thailand, Vietnam, Singapore, and 
Malaysia. 

FjordPhantom spreads via phishing emails, SMS messages, and chat apps. 

 Reader Offer: $50 Amazon gift card with demo 
 Perimeter 81's Malware Protection intercepts threats at the delivery stage 
to prevent known malware, polymorphic attacks, zero-day exploits, and more. 
Let your people use the web freely without risking data and network security. 

 Preferred partner ( What does this mean? ) Beating the Android Sandbox 

The threat actors would impersonate a popular bank in the region and reach 
out to the victims in an attempt to get them to download an app. However, 
together with the legitimate app, the victims would get malicious code 
running in a virtual environment, allowing the operators to attack the real 
banking app. 

The threat actors leveraged open-source projects to create virtual containers 
on the target endpoint, without the users knowledge or consent. When the user 
launches the downloaded APK, it runs the actual banking app in the same 
container with the malicious code, making malware part of the trusted 
process. 

This is dangerous not only because victims might lose their data and money, 
but also because it breaks the Android Sandbox security concept, whose 
premise is that apps cant access each others data. 

Furthermore, as the banking app isnt modified, code tampering detection 
doesnt work, either. The malware is also capable of hampering root-related 
security checks, as well, the researchers said. 

When it comes to the malwares capabilities, it can perform on-device fraud 
and steal banking credentials. Promon says that one victim was able to lose 
$280,000, thanks to a mix of malware and social engineering (the threat 
actors impersonated the banks customer support). 

The best way to protect against such threats is to use common sense and only 
download apps from trusted sources. Also, before downloading an app, make 
sure to check the number of downloads and reviews, as these could be good 
indicators of malware. 

 Via BleepingComputer More from TechRadar Pro These Android apps are nothing 
but adware, but have been installed over 2 million times already - so 
uninstall now Here's a list of the best firewalls around today These are the 
best malware removal tools right now



======================================================================
Link to news story:
https://www.techradar.com/pro/security/this-sneaky-new-android-malware-can-hid
e-in-plain-sight-and-its-all-thanks-to-virtualization


--- Mystic BBS v1.12 A47 (Linux/64)
 * Origin: tqwNet Technology News (1337:1/100)

.