Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Cardbuyer: New Smart Android Trojan Defeats Multi-factor Verification and Steals Prepaid Game Cards

Summary: Unit 42's WildFire analysis cloud detected a new Android Trojan on April 21 that it named Cardbuyer, which was completely undetected in VirusTotal and disguised as a Chinese 'sexy' video app downloaded from fdown.u.qiniudn.com. The Trojan solves CAPTCHAs through the UUDama cloud service, parses and replies to SMS verification messages from vendors, and uses the victim's China Mobile account to buy prepaid and top-up game cards for services including Perfect World's tianxiafu.cn gateway.

Why it matters: Cardbuyer defeats SMS-based multi-factor verification end to end - CAPTCHA, one-time code, and confirmation reply - so any service that treats an SMS reply as proof the phone's owner authorized a charge is exposed, and the victim's mobile account is billed while the attacker converts the codes to cash.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related