Forest Global Training Partners

Cyber Risks · Krebs on Security

Android Botnet Targets Middle East Banks

Summary: A mobile botnet disguised as banking apps for Middle Eastern institutions including Riyad Bank, SAAB, AlAhliOnline, Al Rajhi Bank and Arab National Bank has infected more than 2,700 Android phones and intercepted at least 28,000 text messages. The bot relays incoming SMS one-time codes to its operator, whose interception number +79154369077 traces to a Moscow subscriber on the Mobile Telesystems network, and the same registry details behind funnygammi.com were used to register phony bank domains tied to earlier campaigns against Facebook and banks in Australia and Spain.

Why it matters: The entire attack works by defeating SMS one-time codes, so any bank still treating a texted code as a second factor is trusting a channel the attacker can read. The campaign had been active for at least a year and was already documented by Symantec and Trend Micro before this write-up.

Read the original at Krebs on Security ↗

Topics
Malware
Related