{"id":3101,"date":"2013-11-07T14:16:42","date_gmt":"2013-11-07T19:16:42","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=3101"},"modified":"2020-02-26T10:45:13","modified_gmt":"2020-02-26T15:45:13","slug":"an-android-trojan-swindles-banking-credentials","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/an-android-trojan-swindles-banking-credentials\/3101\/","title":{"rendered":"An Android Trojan Swindles Banking Credentials"},"content":{"rendered":"

Android malware now has a well-established track record of monetary theft<\/a>, which is typically accomplished by sending text messages to premium rate numbers. At the end of summer we wrote about a new Trojan, which was able to steal from a debit\/credit card<\/a> if the card was bound to a phone number. Cybercriminals never stop inventing new ways to steal money or find the means to access money from unsuspecting victims. A new variation of the aforementioned Svpeng Trojan<\/a> uses several tricks to phish for credit card numbers and online banking credentials.<\/p>\n

It is worth mentioning that the specific sample we discovered targets Russian users, however, Russia often serves as a testing ground for cybercriminals. Well-proven schemes usually go overseas quite quickly. For now, the malware appears to be interested in U.S., German, Belarusian and Ukrainian victims.\u00a0Currently the Trojan is configured to mimic popular Russian banks. Upon the launch of the mobile banking app, the Trojan replaces the open window with its own to swindle out the password.<\/p>\n

\"Screen<\/a><\/p>\n

Another implemented attack is more versatile as it targets Google Play users. When victim launch the Android online market app, the Trojan overlaps Google\u2019s windows with its own and proposes that users add a credit card to the account.<\/p>\n

\"Screen<\/a><\/p>\n

During three months of the Trojan\u2019s existence, Kaspersky Lab has discovered over 50 modifications of this malware, which means that criminals recognize its high \u201ccommercial value\u201d. No doubt, we will see new versions of the Trojan that will able to steal from clients of various banks in multiple countries very soon. The current version spread itself using SMS spam, but other variations might utilize another infection tactic.<\/p>\n

To avoid infection, follow the Android user golden rules:<\/p>\n