Fake Antivirus and Cleaner Apps Caught Installing SharkBot Android Banking Trojan

Teilen:

The notorious Android banking trojan known as SharkBot has once again made an appearance on the shoppingmode Google Play Store by masquerading as antivirus and cleaner apps.

“This new dropper doesn’t rely on Accessibility permissions to automatically perform the installation of the dropper Sharkbot malware,” NCC Group’s Fox-IT sagte in a report. “Instead, this new version asks the victim to install the malware as a fake update for the antivirus to stay protected against threats.”

The apps in question, Mister Phone Cleaner and Kylhavy Mobile Security, have over 60,000 installations between them and are designed to target users in Spain, Australia, Poland, Germany, the U.S., and Austria –

 

  • Mister Phone Cleaner (com.mbkristine8.cleanmaster, 50,000+ downloads)
  • Kylhavy Mobile Security (com.kylhavy.antivirus, 10,000+ downloads)

Die droppers are designed to drop a new version of SharkBot, dubbed V2 by Dutch security firm ThreatFabric, which features an updated command-and-control (C2) communication mechanism, a domain generation algorithm (DGA), and a fully refactored codebase.

Mr Phone cleaner

Fox-IT said it discovered a newer version 2.25 on August 22, 2022, that introduces a function to siphon cookies when victims log in to their bank accounts, while also removing the ability to automatically reply to incoming messages with links to the malware for propagation.

By eschewing the Accessibility permissions for installing SharkBot, the development highlights that the operators are actively tweaking their techniques to avoid detection, not to mention find alternative methods in the face of shoppingmode Google‘s newly imposed restrictions to curtail the abuse of the APIs.

 

Other notable information stealing capabilities include injecting fake overlays to harvest bank account credentials, logging keystrokes, intercepting SMS messages, and carrying out fraudulent fund transfers using the Automated Transfer System (ATS).

It’s no surprise that malware poses an evolving and omnipresent threat, and despite continued efforts on the part of shoppingmode Apple und shoppingmode Google, app stores are vulnerable to unknowingly being abused for distribution, with the developers of these apps trying every trick in the book to dodge security checks.

“Until now, SharkBot’s developers seem to have been focusing on the dropper in order to keep using shoppingmode Google Play Store to distribute their malware in the latest campaigns,” researchers Alberto Segura and Mike Stokkel said.

https://thehackernews.com/2022/09/fake-antivirus-and-cleaner-apps-caught.html?

Kommentar verfassen

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert

lade-bild
London, GB
4:30 am, Juli 11, 2025
Wetter-Symbol 17°C
L: 16° | H: 19°
aufgelockerte Bewölkung
Luftfeuchtigkeit: 81 %
Druck: 1021 mb
Wind: 3 mph SSE
Windböe: 6 mph
UV-Index: 0
Niederschlag: 0 mm
Wolken: 45%
Regen Chance: 0%
Sichtbarkeit: 10 km
Sonnenaufgang: 4:56 am
Sonnenuntergang: 9:15 pm
TäglichStündlich
Tägliche VorhersageStündliche Vorhersage
Today 10:00 pm
Wetter-Symbol
16° | 19°°C 0 mm 0% 8 mph 77 % 1021 mb 0 mm/h
Tomorrow 10:00 pm
Wetter-Symbol
19° | 30°°C 0 mm 0% 10 mph 66 % 1019 mb 0 mm/h
So. Juli 13 10:00 pm
Wetter-Symbol
18° | 30°°C 0 mm 0% 7 mph 71 % 1015 mb 0 mm/h
Mo. Juli 14 10:00 pm
Wetter-Symbol
18° | 28°°C 1 mm 100% 15 mph 84 % 1016 mb 0 mm/h
Di. Juli 15 10:00 pm
Wetter-Symbol
14° | 20°°C 1 mm 100% 14 mph 81 % 1017 mb 0 mm/h
Today 7:00 am
Wetter-Symbol
18° | 19°°C 0 mm 0% 2 mph 77 % 1021 mb 0 mm/h
Today 10:00 am
Wetter-Symbol
24° | 27°°C 0 mm 0% 2 mph 57 % 1021 mb 0 mm/h
Today 1:00 pm
Wetter-Symbol
30° | 30°°C 0 mm 0% 3 mph 32 % 1020 mb 0 mm/h
Today 4:00 pm
Wetter-Symbol
32° | 32°°C 0 mm 0% 4 mph 26 % 1018 mb 0 mm/h
Today 7:00 pm
Wetter-Symbol
30° | 30°°C 0 mm 0% 6 mph 29 % 1017 mb 0 mm/h
Today 10:00 pm
Wetter-Symbol
23° | 23°°C 0 mm 0% 8 mph 49 % 1019 mb 0 mm/h
Tomorrow 1:00 am
Wetter-Symbol
21° | 21°°C 0 mm 0% 5 mph 57 % 1019 mb 0 mm/h
Tomorrow 4:00 am
Wetter-Symbol
19° | 19°°C 0 mm 0% 5 mph 66 % 1018 mb 0 mm/h
Name Preis24H (%)
Bitcoin(BTC)
€99,593.14
4.84%
Ethereum(ETH)
€2,537.36
6.75%
Fesseln(USDT)
€0.85
-0.01%
XRP(XRP)
€2.20
6.14%
Solana(SOL)
€140.63
4.16%
USDC(USDC)
€0.85
0.00%
Dogecoin(DOGE)
€0.169678
9.79%
Shiba Inu(SHIB)
€0.000012
8.24%
Pepe(PEPE)
€0.000011
15.23%
Peanut das Eichhörnchen(PNUT)
€0.250498
23.38%
Nach oben scrollen