Cybersecurity experts have warnedd of a new Android malware capable of taking over the target endpoint (opens in new tab) and using it to steal data, exfiltrate personally identifiable information (PII), and make financial transactions.
Discovered by researchers at security firm ThreatFabric, the malware is called Hook, and can be bought on the dark web.
In its report (opens in new tab), the ThreatFabric team note that Hook is essentially a banking trojan. Code-wise, it seems to be quite similar to Ermac, another popular trojan, and even shares numerous features with the infamous malware. However, there are a few standout features, including the use of VNC (virtual network computing) to take over the mobile device. Hook also comes with WebSocket communication features, and encrypts its traffic using the AES-256-CBC hardcoded key.
Unique features
Hook’s other notable features include performing specific swipe gestures, taking screenshots, simulating key presses, scrolling, and simulating a long-press event. The malware can also be used as a File Manager app, the researchers further warned, allowing users to list all of the files residing on the endpoint and exfiltrating the ones they deem worthy.
“With this feature, Hook joins the ranks of malware families that are able to perform full DTO, and complete a full fraud chain, from PII exfiltration to transaction, with all the intermediate steps, without the need of additional channels,” the team warns.
“This kind of operation is much harder to detect by fraud scoring engines, and is the main selling point for Android bankers.”
The silver lining, as is usual with Android devices, is that the user needs to grand the Accessibility Service permissions for the malware to reach its true potential. Those that do, can also expect their location to be revealed, as Hook is also able to abuse the “Access Fine Location” permission.
Targets are scattered all over the world, it seems, with researchers finding compromised devices in the US, the UK, Spain, Poland, Portugal, Italy, France, Canada, Australia, and Turkey.
Via: BleepingComputer (opens in new tab)
Be the first to comment