Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

New Android Trojan “Xbot” Phishes Credit Cards and Bank Accounts, Encrypts Devices for Ransom

Summary: Unit 42 discovered 22 Android apps belonging to a new Trojan family it calls Xbot, which phishes banking credentials and credit card data through fake Google Play payment pages and login screens imitating 7 banks, 6 of them among Australia's most popular. Xbot can also lock infected devices, encrypt files in external storage with a simple XOR-by-50 routine, and demand a U.S. $100 PayPal cash card within 5 days, while stealing all SMS messages and contacts and parsing messages for mTANs.

What you should know: The malware's C2 server decides which fake login page to display, so the operator can add new bank targets without shipping a new version of the code - and the ransom page is remote too, meaning the $100 demand can change at any time.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related