'ZDNET Recommends': What exactly does it mean?
ZDNET's recommendations are based on many hours of testing, research, and comparison shopping. We gather data from the best available sources, including vendor and retailer listings as well as other relevant and independent reviews sites. And we pore over customer reviews to find out what matters to real people who already own and use the products and services we’re assessing.
When you click through from our site to a retailer and buy a product or service, we may earn affiliate commissions. This helps support our work, but does not affect what we cover or how, and it does not affect the price you pay. Neither ZDNET nor the author are compensated for these independent reviews. Indeed, we follow strict guidelines that ensure our editorial content is never influenced by advertisers.
ZDNET's editorial team writes on behalf of you, our reader. Our goal is to deliver the most accurate information and the most knowledgeable advice possible in order to help you make smarter buying decisions on tech gear and a wide array of products and services. Our editors thoroughly review and fact-check every article to ensure that our content meets the highest standards. If we have made an error or published misleading information, we will correct or clarify the article. If you see inaccuracies in our content, please report the mistake via this form.
Google Play app dropped Vultur banking Trojan on Android handsets
A Trojanized 2FA authenticator app has been removed from the Google Play Store.
ZDNET Recommends
The app, 2FA Authenticator, was discovered by the Pradeo security team.
According to a cached version of the app's page on Google Play, the developer said the software provided a "secure authenticator for your online services, while also including some features missing in existing authenticator apps, like proper encryption and backups."
Update 8.57GMT, 5/2: The malicious app, 2FA Authenticator, is not the same and should not be confused with 2FA Authenticator (2FAS), which is available on Google Play.
In addition, the app claimed to support HOTP and TOTP and was marketed as a way to import other authenticator protocols -- including Authy, Google Authenticator, Microsoft Authenticator, and Steam -- and host them in one place.
The app was downloaded and installed over 10,000 times during its time on Google Play.
However, the app was less about protecting your data and more about stealing it. According to Pradeo, the app would act as a dropper for malware designed to steal financial information upon installation.
"It has been developed to look legitimate and provide a real service," the researchers say. "To do so, its developers used the open-source code of the official Aegis authentication application to which they injected malicious code. As a result, the application is successfully disguised as an authentication tool which ensures it maintains a low profile."
In the first stage of the attack, 2FA Authenticator requests a range of permissions from the handset owner, including camera and biometric access, the ability to tamper with system alerts, package querying, and the ability to disable keylock.
The permissions allow the malware to perform actions including collecting localized data for targeted attacks, disabling keylock and password security, downloading external apps, and creating overlay windows over other mobile application windows.
Once these permissions have been granted, the dropper then installs Vultur.
According to Threat Fabric, Vulture is a Remote Access Trojan (RAT) that is a relatively new entrant to the malware landscape. Vultur uses screen recording and keylogging to capture bank account and financial service credentials rather than traditional overlay functions -- a slower method, but potentially one that is less likely to be detected.
Vultur tends to target European banking institutions as well as a range of cryptocurrency wallet platforms. The dropper used to execute the RAT is a framework called Brunhilda, previously linked to Android malware distribution through fake utility and 2FA apps on Google Play.
In an update, the Pradeo team said the malicious app was removed after being available on the Google Play Store for 15 days. If you try to access the 2FA Authenticator page, you are met with an error display.
Users of the app are advised to delete the software from their handsets.
ZDNet has reached out to Google, and we will update when we hear back.
See also
- New banking Trojan SharkBot makes waves across Europe, US
- Over 300,000 Android users have downloaded these banking trojan malware apps, say security researchers
- This cruel Android malware wipes phones after stealing money
Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0