Malicious App Impersonates McAfee to Distribute Malware Through Textual content and Cellphone Calls

A trojanized model of the McAfee Safety app is putting in the Android banking Trojan “Vultur,” based on researchers at Fox-IT. The attackers are spreading hyperlinks to the malicious app by way of textual content messages and cellphone calls.

“With the intention to deceive unsuspecting people into putting in malware, the risk actors make use of a hybrid assault utilizing two SMS messages and a cellphone name,” the researchers write. “First, the sufferer receives an SMS message that instructs them to name a quantity if they didn’t authorize a transaction involving a big amount of cash. In actuality, this transaction by no means occurred, nevertheless it creates a false sense of urgency to trick the sufferer into appearing shortly.”

If a sufferer calls the cellphone quantity, they’ll obtain one other textual content with a hyperlink to a malicious model of the McAfee Safety app, which is able to set up the Vultur malware.

“A second SMS is distributed in the course of the cellphone name, the place the sufferer is instructed into putting in a trojanized model of the McAfee Safety app from a hyperlink,” Fox-IT says.

“This utility is definitely Brunhilda dropper, which appears to be like benign to the sufferer because it comprises performance that the unique McAfee Safety app would have. As illustrated under, this dropper decrypts and executes a complete of three Vultur-related payloads, giving the risk actors complete management over the sufferer’s cellular gadget.”

The researchers notice that this model of Vultur has new options that make it more durable to detect.

“Probably the most intriguing addition is the malware’s potential to remotely work together with the contaminated gadget by way of using Android’s Accessibility Companies,” the researchers write.

“The malware operator can now ship instructions with a view to carry out clicks, scrolls, swipe gestures, and extra. Firebase Cloud Messaging (FCM), a messaging service supplied by Google, is used for sending messages from the C2 server to the contaminated gadget. The message despatched by the malware operator by way of FCM can include a command, which, upon receipt, triggers the execution of corresponding performance inside the malware. This eliminates the necessity for an ongoing reference to the gadget.”

KnowBe4 empowers your workforce to make smarter safety selections day-after-day. Over 65,000 organizations worldwide belief the KnowBe4 platform to strengthen their safety tradition and scale back human danger.

Fox-IT has the story.