A malicious Android app is trying to scam Brazilian bank customers

Some of the Brazilian banks targeted operate in Spain, Portugal and across Latin America, according to IBM.

Brazil’s financial sector, which has long grappled with cybercrime, has a new foe.

An insidious Android application is trying to steal users’ login credentials, and their money, by impersonating Brazilian banks, researchers from IBM Security said Tuesday.

The malicious code is designed to steal the text messages that people use as a secondary security measure to log into their bank accounts. While focused on Brazil, the code could be repurposed to target banking sectors elsewhere, the researchers warned.

It is the latest hacking tool to be aimed at Brazil’s financial sector, which has had to contend with cybercrime for years.

“Malware of this type is extremely simple to redirect to other regions by changing the target list and embedded screens, thereby modifying its attack turf and potential targets,” IBM researchers Ben Wagner and Limor Kessem wrote in a blog post.

Some of the Brazilian banks targeted operate in Spain, Portugal and across Latin America, according to IBM. The researchers didn’t name the targeted entities, and it remains unclear if any of the phishing attempts were successful.

IBM researchers also reported this month on another piece of malware that apparently originated in Brazil, but was being used to attack bank customers in Spain.

The code in the newest banking trojan — as the credential-stealing malware is called — is entirely new, according to IBM. But it uses a trick that is increasingly popular with cybercriminals: It lurks in the background of a user’s phone until the right time to display a fake banking login page. The success of the attack hinges on whether the person takes the bait and enters their credentials.

The hackers were sloppy in covering their tracks. Wagner and Kessem said the malware was easy to reverse-engineer and, unlike similar hacking tools, does not check whether it is being deployed in a virtual environment before installing.

“Malware is often created in a very agile development cycle, released as soon as a working module can help attackers achieve their goals,” Kessem told CyberScoop. “This malware is likely a work in progress and we may end up seeing it evolve further in the coming months.”

While Google has hired mobile security firms to clamp down on the number of malicious apps that appear in the Play Store, hackers have leveraged third-party app stores to get their malware onto Android phones.

With this new banking trojan, scammers are sending instructions to potential victims on how to download the app from a third-party source, beyond the reach of the Play Store’s gatekeepers.

Potent Brazilian banking trojan resurfaces in South America, despite arrests that averted $4M theft

Police in Spain might averted big losses with some Mekotio-related arrests earlier this year, but the malware is back.

Crooks behind Ghimob banking trojan have ambitions far beyond Brazil, researchers say

In Brazil, scammers see the coronavirus as a serious money-making opportunity

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure