Bitcoin Forum

There is a new Android banking malware which evolves to steal crypto users credentials as well. And it used to target Brazilian banks, but now it has grown and evolved and expanded it targets to include other banking system as well.


https://i.imgur.com/NzjnjlB.jpg

So do not download anything that mimicked the following.

• Google Defender
• Google Docs
• WhatsApp Update
• Flash Update

https://www.zdnet.com/article/new-ghimob-malware-can-spy-on-153-android-mobile-applications/

In did not mentioned which crypto apps in it, but according to this report (https://securelist.com/ghimob-tetrade-threat-mobile-devices/99228/), it's 13 crypto apps from different countries.

I’ve searched around for the list of targeted apps, but it is still nowhere to be found.

So what Ghimob does once installed and camouflaged, is read fields from the current active window, searching for specific terms, and then sends this information over to the hacker. Information such as login credentials, balance and statements are gathered, so the hacker will get to know both the financial status, and how to access the targeted accounts.

https://securelist.com/ghimob-tetrade-threat-mobile-devices/99228/

And what it more scary is that the security researchers didn't disclose the supposedly thirteen crypto related apps that has been targeted by this malware or trojan. Although it started to just attack Brazilian apps, it has forked to other banking apps within it's neighbours so it is very dangerous.

"Germany (five apps), Portugal (three apps), Peru (two apps), Paraguay (two apps), Angola and Mozambique (one app per country)."

Also worth to mentioned that the way they distributed this malicious apps is thru emails and not from Google Play Store.

So the best option for us right now and not to trust anything, specially countries mentioned in the research.


Again, this is very old tactic, even prior to the advent of crypto scams, emails is the only attack vector for this cyber criminals. So have a good security practice, educate ourselves, check everything before clicking any links or our inbox. Even if the source of the email is known to us, we still need to be skeptical.

I also have to dig deeper and found this one, it only mention Bittrex that time, but it has really evolved to target more of crypto exchanges/apps (I will just assumed here).


Sources:

https://malpedia.caad.fkie.fraunhofer.de/details/win.astaroth
https://securelist.com/the-tetrade-brazilian-banking-malware/97779/

Calmly, I see the list and I don't use most of them.

And for the people who like accessing their bank accounts through browsers and official banking apps, they need to be more aware of this. I guess many of the folks here are doing it.

Nothing to worry about if they know how to protect themselves by not clicking unwanted email links and avoiding downloading unwanted apps.

Well it mentioned Bittrex, but top ten exchanges like Binance and Coinbase has been in their crosshairs.

And thanks for updating it, at least even though I don't reside on the countries mention, it is still better to be aware that there is a potential for cyber actors that this kind of trojans can developed gradually and could target more banking apps and more crypto exchange apps.

It's good to not trust anything anyway because it usually takes a while for security firms to detect the new viruses/trozens. One simple thing android users can do is to be careful about permissions they give to apps.