Mobile banking Trojan bypasses Google Play security
The Acecard malware is capable of attacking users of nearly 50 different online financial applications and services and is able to bypass Google Play store security measures, according to Kaspersky Lab.
During the third quarter of 2015, Kaspersky Lab experts detected an unusual increase in the number of mobile banking attacks in Australia. The suspicious activity was discovered to be the result of a single banking Trojan: Acecard.
Acecard mobile banking Trojan family
The Acecard Trojan family uses almost every malware functionality currently available – from stealing a bank’s text and voice messages to overlaying official app windows with false messages that simulate the official login page in an attempt to steal personal information and account details.
The most recent versions of the Acecard family can attack the client applications of some 30 banks and payment systems. Considering that these Trojans are capable of overlaying any application upon command, the overall number of attacked financial applications may be much higher.
Besides banking apps, Acecard can overlay the following applications with phishing windows:
- IM services: WhatsApp, Viber, Instagram, Skype
- Social networks: VKontakte, Odnoklassniki, Facebook, Twitter
- The Gmail client
- The PayPal mobile app
- Google Play and Google Music applications.
Detection
This mobile banking Trojan was first detected in February 2014, but for a long period it showed almost no signs of malicious activity. Everything changed in 2015 when Kaspersky Lab researchers detected a spike in attacks during May to December 2015. During that time more than 6,000 users were attacked with this Trojan. Most of them were living in Russia, Australia, Germany, Austria and France.
During the two years of observation, Kaspersky Lab researchers witnessed the active development of the Trojan. They registered more than 10 new versions of the malware, each with a far longer list of malicious functions than the previous one.
Number of Acecard files detected each month:
Who’s behind it?
Looking closely at the malware code, Kaspersky lab experts are inclined to think that Acecard was created by the same group of cybercriminals that was responsible for the first TOR Trojan for Android Backdoor.AndroidOS.Torec.a and the first mobile encryptor/ransomware Trojan-Ransom.AndroidOS.Pletor.a.
The evidence for this is based on similar code lines (names of methods and classes) and the use of the same Command and Control servers. This proves that Acecard was made by a powerful and experienced group of criminals, most likely Russian-speaking.
“This cybercriminal group uses virtually every available method to propagate the banking Trojan Acecard. It can be distributed under the guise of another program, via official app stores, or via other Trojans. The combination of Acecard’s capabilities and methods of propagation make this mobile banker one of the most dangerous threats to users today,” warns Roman Unuchek Senior Malware Analyst at Kaspersky Lab USA.