{Warning}: New "Alien" malware targets banking and crypto apps

[Baofeng]

Another strain of malware has been discovered by cyber threat security researches and aptly called "Alien". It's a new strain of android malware which targets banking and crypto apps and a wide array of other targets like social media, instant messaging apps. In total 226 apps where discovered.

Here are the crypto apps included in the list:






The full list can be found here, including gmail, netflix and a host of banking apps. https://www.threatfabric.com/blogs/alien_the_story_of_cerberus_demise.html

[1714643921]

1714643921

[1714643921]

1714643921

[1714643921]

1714643921

[1714643921]

1714643921

[1714643921]

1714643921

[1714643921]

1714643921

[NeuroticFish]

The full list can be found here, including gmail, netflix and a host of banking apps. https://www.threatfabric.com/blogs/alien_the_story_of_cerberus_demise.html

The list is big and I've seen some more names there that are worrisome: WhatsApp and Mycelium.
WhatsApp because some think that since "it's encrypted" they can send whatever sensitive info.
And Mycelium is imho one of the most popular Android wallets. If seed or private key is lost.. ouch!

[stompix]

What pisses me off on some of those researches about viruses and malware is they forget to add one critical fact, how it happens

ThreatFabric didn't include details about how Alien makes its way onto users' devices, primarily because this varies based on how the Alien MaaS customers (other criminal groups) chose to distribute it.
"A lot of it seems distributed via phishing sites, for example malicious page tricking the victims into downloading fake software updates or fake Corona apps (still a common trick at the moment)," Gaetan van Diemen, a malware analyst at ThreatFabric, told ZDNet.

All of these shady Alien-tainted apps can be easily spotted as they often require users to grant them access to an admin user or to the Accessibility service.

So, don't download crappy apps and don't give an app that tells you what to eat to lose 500 pounds admin privileges.
Basically, the same story as always, be careful what you insall on your devices!

The list is big and I've seen some more names there that are worrisome: WhatsApp and Mycelium.
WhatsApp because some think that since "it's encrypted" they can send whatever sensitive info.

There is one worse than that, gmail! Lose control over your email and good luck recovering all the accounts linked to it.

[DdmrDdmr]

The thing is that Alien MaaS is like a middleware base for other crafty criminals to use as they see fit into their subsequent developments, potentially being implemented into an array of fake apps, and used to execute one or various of the malignant features listed in the referenced article in the OP, which include (I think it’s interesting to make them explicit here):

•   Overlaying: Dynamic (Local injects obtained from C2)
•   Keylogging
•   Remote access
•   SMS harvesting: SMS listing
•   SMS harvesting: SMS forwarding
•   Device info collection
•   Contact list collection
•   Application listing
•   Location collection
•   Overlaying: Targets list update
•   SMS: Sending
•   Calls: USSD request making
•   Calls: Call forwarding
•   Remote actions: App installing
•   Remote actions: App starting
•   Remote actions: App removal
•   Remote actions: Showing arbitrary web pages
•   Remote actions: Screen-locking
•   Notifications: Push notifications
•   C2 Resilience: Auxiliary C2 list
•   Self-protection: Hiding the App icon
•   Self-protection: Preventing removal
•   Self-protection: Emulation-detection
•   Architecture: Modular

A less technical article on the topic would be this one: https://www.zdnet.com/article/new-alien-malware-can-steal-passwords-from-226-android-apps/

One worrying feature stated in the above article is that Alien provides native inbuilt capabilities that serve as a basis to create fake login pages from multiple banking entities, aside from social sites, besides Coinbase, Blockchain wallet, Mycelium, Luno, Spectrocoin.

[Jating]

So Cerberus is out, but lo and behold another new malware enter into the picture and I would say that it is more dangerous than ever at it has a lot of targets in its path.

Yes, skrill, payoneer, yahoo mail and mostly scattered banks around the world.

[bitsurfer2014]

Aside from avoiding any downloading of apps on an unverified site, perhaps its high time to invest a little more on our systems / mobile device's security (e.g. subscribing to popular security apps) that would minimize our chances of being pawned.

If we can't do it, at least we should regularly update any antivirus apps so that we have to keep our defences more active.

[Becky666]

They will keep launching attacks but it's important we all have our doggedness in exposing their acts. Basically, this attack has called for more stringent actions from cryptocurrency holders, make it a work that must be done: 'always make your password changes regularly'(updating passwords).

This also called for individual alertness, the responsibility of keep safe in this industry solely depends on individuals, so, act smartly. There are enough warnings and guides around the forum that will be of help to noons in this regard.

[taufik123]

From 226 applications the credential theft list targets all social media applications such as Facebook, Instagram, Twitter and popular chat applications Telegram and whatsapp. This will be very dangerous, because almost everyone uses the application. Not only that, Google play and Gmail are very crucial targets because they contain very important information.

Malware like this can appear anywhere such as making unauthorized downloads and on phishing websites. Advertisements that appear on their own when visiting a page are also a source of malware.

-snip-
WhatsApp because some think that since "it's encrypted" they can send whatever sensitive info.

Not only a few people, but the majority of WhatsApp users already believe that this application is encrypted and cannot be hacked easily. but when I read this article about "Alien" malware, how vulnerable are all the applications I use. Maintaining security is very important and the most important also is not to download and install unknown applications. give more protection on the device the better.

[NeuroticFish]

Not only a few people, but the majority of WhatsApp users already believe that this application is encrypted and cannot be hacked easily

The trick is to get the message before it's encrypted or after it's decrypted. Even Facebook had plans to stick their nose in there, I don't know if they did it already or not.

There is one worse than that, gmail! Lose control over your email and good luck recovering all the accounts linked to it.

I shortly thought about adding GMail, but then I thought that we keep telling people to not keep their private keys and so on in e-mail.
But you're so right, I forgot about accounts on various services. Indeed, e-mail is necessary not only for recovering the account, but also for approving certain operations, including funds withdrawal.

[Lucius]

Aside from avoiding any downloading of apps on an unverified site, perhaps its high time to invest a little more on our systems / mobile device's security (e.g. subscribing to popular security apps) that would minimize our chances of being pawned.

If we can't do it, at least we should regularly update any antivirus apps that we have to keep our defences more active.

I have always had an attitude towards my mobile device in the same way as to my computer, which means that I have always taken care that it has the latest update and that it has some solid AV, with of course great caution for every app I install from Play Store. The problem is that many of today's mobile devices are out of date (too old to get updates) and apps like AV slow them down because of the very low RAM and weak CPU - and that's exactly what hackers are counting on.

What pisses me off on some of those researches about viruses and malware is they forget to add one critical fact, how it happens

If you get a message on any social network or via SMS/e-mail from a pretty girl who sends you her pictures or video I would bet it's malware. Of course, hackers are very resourceful in achieving their goal, and what children need to be taught in kindergarten is that the Internet is a very dangerous place and that everything should be approached with a great deal of caution. Some would say that it may be too early for children to deal with such things, but iron is forged while it is hot - of course if we want a future with fewer who will be victims of such things.

[jademaxsuy]

and there too many of them actually could be find with due diligent in finding these kind of malware. However, I'm afraid that within an instant clicking the malware might end up all your financial accounts will.be disclosed without you knowing or being careful. So, it should be a good practice to keep away from such links for malware.and be always careful to visit sites you are constantly visiting. Who knows malware directed you to a wrong or imitating fake site.

[Assface16678]

Ow, this one is a bit risky than other things because it attacks specifically the cryptocurrency app. It's better to download files and applications to the secured ones we are preventing this spread and damage our funds. It's better if we are trying to keep an antivirus even on our smartphones because this may help a lot to delete some junk files and to scan if there is something program that doesn't need or an intruder.

Just my opinion I think the apple users don't need to worry about because they have an apple store which is one of the most secured platforms on downloading applications because every time before they publish an app they will scan all of the codes inside of it.

[$crypto$]

It is very worrying that all other banking and chat applications included in this list will be very dangerous, especially in Android software because these devices can download without permission, you can imagine if the alien malware enters without knowing from us, oh no, this will disappear. whatever contains of our banking as they have deep dive into the most popular and widely used applications.
Like I use Whatapp, Paypa, Google Play etc., many applications that I use, of course this is very alert for me to the link, one click can make me lose more money because of the new malware.

[pakhitheboss]

That is why it is recommended, use Desktop devices to access your bank account online and Desktop wallets to store your crypto asset. If you have a large quantity then always use a hardware wallet. Android is prone to attack because it is open source whereas you will hear very fewer security issues for iOS devices.

[Swordsoffreedom]

Verified applications by Play-Protect from the playstore should be used without downloading applications from online. Most of the online applications are modified version. No program should be used from unknown source. I read a few articles about "Alien" that scared me, which made me realize that no app is safe unless we use it properly.

[bitsurfer2014]

Aside from avoiding any downloading of apps on an unverified site, perhaps its high time to invest a little more on our systems / mobile device's security (e.g. subscribing to popular security apps) that would minimize our chances of being pawned.

If we can't do it, at least we should regularly update any antivirus apps that we have to keep our defences more active.

I have always had an attitude towards my mobile device in the same way as to my computer, which means that I have always taken care that it has the latest update and that it has some solid AV, with of course great caution for every app I install from Play Store. The problem is that many of today's mobile devices are out of date (too old to get updates) and apps like AV slow them down because of the very low RAM and weak CPU - and that's exactly what hackers are counting on.

That is correct! Most of today's mobile antivirus / security apps  are very resource hungry that majority of low-end to mid- range mobile devices owners don't have the required resources as what you've pointed out (e.g. RAM, slow CPU and low storage capabilities, ...) to install good security apps.

Moreover, what is more bothering here is that there are significant number of mobile device owners that appear to be less security conscious or doesn't  even have the elementary skills to enhance their devices security and won't even bother to install any security apps - hence creating more easier attack vectors for hackers.

Reference:
A survey on smartphone user’s security choices, awareness and education

[hugeblack]

It is strange that many people do not care about your privacy, they download any application that appears in the store.
Also, google play does not check apps fast enough before they spread viruses.
I haven't read all the details but in the quarantine period it looks perfect for those who want to do these activities as a lot of people looking to explore more applications.

[libert19]

That is why it is recommended, use Desktop devices to access your bank account online and Desktop wallets to store your crypto asset.

I doubt desktop is any better than android.

[Lucius]

Verified applications by Play-Protect from the playstore should be used without downloading applications from online.

One should not rely at all on the fact that Google can or wants to control all the applications in its store at all - this is a job that they simply cannot do efficiently at the moment. Therefore, each application should be approached with caution, and before downloading try to find a review or read the comments (although they can sometimes be false).

Crypto wallets and banking apps should ideally have separate devices on which no suspicious applications should be downloaded.

[cryptomaniac_xxx]

Just my opinion I think the apple users don't need to worry about because they have an apple store which is one of the most secured platforms on downloading applications because every time before they publish an app they will scan all of the codes inside of it.

Even Apple has it's fair share of attacks as well: Mobile security: These seven malicious apps have been downloaded by 2.4m Android and iPhone users.

What I practice though is that I have a device for my mobile apps only, I seldom used this phone. But I'm not saying that I'm safe, but at least the odds are on my side, it's an old Iphone 6 btw.