#ESETresearch identified an #Android banking trojan campaign active since October 2021, targeting 8 Malaysian banks. The malware is distributed via copycat websites of legitimate services – the majority being cleaning services available in Malaysia 🇲🇾. welivesecurity.com/2022/04/06/fak… 1/4 
The copycat websites do not provide an option to shop directly through them. Instead, they include buttons that claim to download apps from #GooglePlay. However, these buttons do not actually lead to the Google Play store, but to malicious apps controlled by the attackers. 2/4
The malicious apps pretend to offer goods and services for purchase while matching the interface of the original stores. At the payment step, victims are presented with a fake FPX payment page, asked to select one of eight Malaysian banks, and enter their credentials. 3/4
The goal of the attackers is to obtain the banking credentials of victims. Once credentials are entered into the phishing forms, the malicious apps display an error message claiming invalid user ID or password.
The malware intercepts received SMS 2FA codes.
@LukasStefanko 4/4
The malware intercepts received SMS 2FA codes.
@LukasStefanko 4/4
• • •
Missing some Tweet in this thread? You can try to
force a refresh
