[ad_1] <br><div id="articlebody"><div class="separator" style="clear: both;"><a target="_blank" href="https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEgaCrnx2tabydf-GaRtGrcqyS1ChyVCBqpYTF19GvO1Sp9PPeFFu_lyPIag6mAkT2JTiCs8u0c_QACkCjfunkd4o0WZ6-Te1p0-4BTkfw9gEOpvUzsNU0LZy0s_dwUbrN7v0Ug50WS5Pwrgp641pz3PfQ5HAU3c3M-2hSeBdtaWgfW-YLWI0YDrbmNI/s728-e100/android-malware-dropper.jpg" style="display: block; text-align: center; clear: left; float: left;" rel="noopener"><img alt="" border="0" data-original-height="380" data-original-width="728" src="https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEgaCrnx2tabydf-GaRtGrcqyS1ChyVCBqpYTF19GvO1Sp9PPeFFu_lyPIag6mAkT2JTiCs8u0c_QACkCjfunkd4o0WZ6-Te1p0-4BTkfw9gEOpvUzsNU0LZy0s_dwUbrN7v0Ug50WS5Pwrgp641pz3PfQ5HAU3c3M-2hSeBdtaWgfW-YLWI0YDrbmNI/s728-e100/android-malware-dropper.jpg"/></a></div> <p>5 malicious dropper Android apps with over 130,000 cumulative installations have been found on the Google Play Retailer distributing banking trojans like <a target="_blank" href="https://thehackernews.com/2022/09/fake-antivirus-and-cleaner-apps-caught.html" rel="noopener">SharkBot</a> and <a target="_blank" href="https://thehackernews.com/2021/07/new-android-malware-uses-vnc-to-spy-and.html" rel="noopener">Vultur</a>, that are able to stealing monetary information and performing on-device fraud.</p> <p>"These droppers proceed the unstopping evolution of malicious apps sneaking to the official retailer," Dutch cell safety agency ThreatFabric instructed The Hacker Information in a press release.</p> <p>"This evolution consists of following newly launched insurance policies and masquerading as file managers and overcoming limitations by side-loading the malicious payload by way of the online browser."</p> <p>Targets of those <a target="_blank" href="https://www.threatfabric.com/blogs/the-attack-of-the-droppers" rel="noopener">droppers</a> embrace 231 banking and cryptocurrency pockets apps from monetary establishments in Italy, the U.Okay., Germany, Spain, Poland, Austria, the U.S., Australia, France, and the Netherlands.</p>
<p>Dropper apps on official app shops like Google Play have <a target="_blank" href="https://thehackernews.com/2022/07/over-dozen-android-apps-on-google-play.html" rel="noopener">increasingly</a> <a target="_blank" href="https://thehackernews.com/2022/08/cybercriminals-developing-bugdrop.html" rel="noopener">become</a> a well-liked and environment friendly approach to distribute banking malware to unsuspecting customers, even because the menace actors behind these campaigns regularly refine their ways to <a target="_blank" href="https://support.google.com/googleplay/android-developer/answer/12766072" rel="noopener">bypass restrictions</a> imposed by Google.</p> <div class="separator" style="clear: both;"><a target="_blank" href="https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEhatL2zggyAwobUkCD0wQlpqcN3mup0BUTINYiZBe9F1Vz1J-n3ZF9ZcX-KhN-CJkYXuBJQCur6S7r512kXwwf72Ls14rREhH5xyPrpf3sOQl1JKegtKwbbBLED894gDGbVvepzsUUzNj_Iswz_NXC53yNzxXacw2LPhhJxnQrouVBhAqiVp1RJyUQK/s728-e100/1.jpg" style="clear: left; display: block; float: left; text-align: center;" rel="noopener"><img alt="" border="0" data-original-height="410" data-original-width="728" src="https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEhatL2zggyAwobUkCD0wQlpqcN3mup0BUTINYiZBe9F1Vz1J-n3ZF9ZcX-KhN-CJkYXuBJQCur6S7r512kXwwf72Ls14rREhH5xyPrpf3sOQl1JKegtKwbbBLED894gDGbVvepzsUUzNj_Iswz_NXC53yNzxXacw2LPhhJxnQrouVBhAqiVp1RJyUQK/s728-e100/1.jpg"/></a></div> <p>The record of malicious apps, 4 of that are nonetheless out there on the digital market, is under -</p>
<p>The newest wave of SharkBot assaults aimed toward Italian banking customers because the begin of October 2022 entailed the usage of a dropper that masqueraded as an to find out the tax code within the nation ("Codice Fiscale 2022").</p> <div class="separator" style="clear: both;"><a target="_blank" href="https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEjZEwGlEyTCVsvlo29VD3_n28bBWodDVZqrHezqHt4V5MZkv22VooirpaXoljr9B_HVB5vjlWx5EQEMpdeeK9nsqydT4vWd2D0xawS5ztYR2fKuCftTIblEoVM6DVkA1TDA6g4JhPQ2Syi3oOw6oXPHXvsFm_fbRx6Kv75sBvfIdc5iKMV_FhcTodPY/s728-e100/2.jpg" style="clear: left; display: block; float: left; text-align: center;" rel="noopener"><img alt="" border="0" data-original-height="410" data-original-width="728" src="https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEjZEwGlEyTCVsvlo29VD3_n28bBWodDVZqrHezqHt4V5MZkv22VooirpaXoljr9B_HVB5vjlWx5EQEMpdeeK9nsqydT4vWd2D0xawS5ztYR2fKuCftTIblEoVM6DVkA1TDA6g4JhPQ2Syi3oOw6oXPHXvsFm_fbRx6Kv75sBvfIdc5iKMV_FhcTodPY/s728-e100/2.jpg"/></a></div> <p>Whereas Google's Developer Program Coverage limits the usage of the <a target="_blank" href="https://support.google.com/googleplay/android-developer/answer/12085295" rel="noopener">REQUEST_INSTALL_PACKAGES permission</a> to stop it from being abused to put in arbitrary app packages, the dropper, as soon as launched, will get round this barrier by opening a pretend Google Play retailer web page impersonating the app itemizing, resulting in the obtain of the malware below the guise of an replace.</p> <p>Outsourcing the malware retrieval to the browser will not be the one technique adopted by prison actors. In one other occasion noticed by ThreatFabric, the dropper posed as a file supervisor app, which, per Google's revised coverage, is a class that is allowed to have the REQUEST_INSTALL_PACKAGES permission.</p> <div class="ad_two clear"><center class="cf"><a target="_blank" href="https://go.thn.li/crowd-mid-d" rel="nofollow noopener sponsored" title="CyberSecurity"><img decoding="async" alt="CyberSecurity" class="lazyload" loading="lazy" src="https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEglTybVbyQ3y6xCIxW9BIpqhgWBf_IhNgCo44HrgwUeYVi_GwvasznH93LLdkqJLwdp4DUkFkILg6m3WDgkue7MFxmbzFxmTBe7-pukEjyvUZ3j9yGyBcL2yUAZVFSQkjSric7YYfU8WgwHwYsS2-3wZ1zLQDAqgkoEpk5kZsbUuyh0UlV8nq7PplYEgQ/s1600/banners-crowdsec-728.png" width="728" height="90"/></a></center></div> <p>Additionally noticed have been three droppers that supplied the marketed options but additionally got here with a covert perform that prompted the customers to put in an replace upon opening the apps and grant them permission to put in apps from unknown sources, resulting in the supply of Vultur.</p> <p>The brand new variant of the trojan is notable for including capabilities to extensively log person interface parts and interplay occasions (e.g., clicks, gestures, and so forth.), which ThreatFabric stated may very well be a workaround to the usage of the <a target="_blank" href="https://developer.android.com/reference/android/view/WindowManager.LayoutParams#FLAG_SECURE" rel="noopener">FLAG_SECURE window flag</a> by banking apps to stop them from being captured in screenshots.</p> <p>The findings from ThreatFabric additionally come as Cyble <a target="_blank" href="https://blog.cyble.com/2022/10/27/drinik-malware-returns-with-advanced-capabilities-targeting-indian-taxpayers/" rel="noopener">uncovered</a> an upgraded model of the <a target="_blank" href="https://www.cert-in.org.in/s2cMainServlet?pageid=PUBADV01&CACODE=CICA-2021-2970" rel="noopener">Drinik Android trojan</a> that targets 18 Indian banks by impersonating the nation's official tax division app to siphon private info by way of the abuse of the accessibility providers API.</p> <p>"Distribution by way of droppers on Google Play nonetheless stays probably the most 'inexpensive' and scalable approach of reaching victims for many of the actors of various ranges," the corporate famous.</p> <p>"Whereas refined ways like <a target="_blank" href="https://thehackernews.com/2022/10/hackers-using-vishing-tactics-to-trick.html" rel="noopener">telephone-oriented attack delivery</a> require extra assets and are exhausting to scale, droppers on official and third-party shops permit menace actors to succeed in a large unsuspecting viewers with affordable efforts."</p> <br/>
</div><script> //<![CDATA[ head.ready("jqueryfile",function(){$("a[href^='#link_share']").each(function(){var e=$(this).attr("data-sm"),t="";"facebook"==e&&(t="https://www.facebook.com/sharer.php?u="+share_url),"twitter"==e&&(t="https://twitter.com/intent/tweet?url="+share_url+"&text="+share_title+"&via=TheHackersNews"),"linkedin"==e&&(t="https://www.linkedin.com/shareArticle?mini=true&url="+share_url),"reddit"==e&&(t="https://www.reddit.com/submit?url="+share_url),"hackernews"==e&&(t="https://news.ycombinator.com/submitlink?u="+share_url+"&t="+share_title),"email"==e&&(t="mailto:?&subject=News Article—"+share_title+"&body=Check out this article from The Hacker News. n n n"+share_title+" — "+share_url),"whatsapp"==e&&(t="https://api.whatsapp.com/send?text="+share_title+" — "+share_url),"facebook-m"==e&&(t="fb-messenger://share/?link="+share_url+"&app_id=280117418781535"),"telegram"==e&&(t="https://telegram.me/share/url?url="+share_url+"&text="+share_title),$(this).attr("href",t)}),$(".show-comments").on("click",function(){var e=document.createElement("script");e.src="https://connect.facebook.net/en_US/sdk.js#xfbml=1&appId=280117418781535&version=v2.12",document.body.appendChild(e),$(".sharebelow-comment").hide(),$(".comments").show()});var e=$(".articlebody").offset().top,t=!1;$(window).scroll(function(){$(window).scrollTop()>e&&!t&&(jQuery.ajax({url:"https://thehackernews.com/feeds/posts/default?alt=json&max-results=4",type:"get",cache:!1,dataType:"jsonp",success:function(e){for(var t="",s="",r=0;r<e.feed.entry.length;r++){for(var a,l=0;l<e.feed.entry[r].link.length;l++)if("alternate"==e.feed.entry[r].link[l].rel){t=e.feed.entry[r].link[l].href;break}100<(a=(a="content"in e.feed.entry[r]?e.feed.entry[r].content.$t:"summary"in e.feed.entry[r]?e.feed.entry[r].summary.$t:"").replace(/<S[^>]*>/g,"")).length&&(a=a.substring(0,90));var n=(n=e.feed.entry[r].title.$t).substring(0,50),o=(o=e.feed.entry[r].media$thumbnail.url.replace(//s72-c-e100/,"/s260-e100"));s+='<article class="latest cf"><a target="_blank" class="latest-link" href="'+t.replace("https://","https://")+'"><div><img decoding="async" src="'+o+'" alt="'+n+'"/></div><div><div class="latest-h3">'+n+'...</div></div><div class="latest-desc">'+a+"...</div></a></article>"}s+="",document.getElementById("result").innerHTML=s}}),t=!0)})}); //]]> </script><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> <br>[ad_2] <br><a href="https://news.google.com/__i/rss/rd/articles/CBMiR2h0dHBzOi8vdGhlaGFja2VybmV3cy5jb20vMjAyMi8xMC90aGVzZS1kcm9wcGVyLWFwcHMtb24tcGxheS1zdG9yZS5odG1s0gEA?oc=5">Source link </a>