RatOn trojan with function for account takeover of crypto wallets

[fullfitlarry]

A new malware was discovered recently with capabilities of of merging overlay attacks + automatic money transfer + NFC relay and cyber investigators says that it is the first of its kind to have this kind functionality making it unique.

What's more is that the banking trojan has also the functionality of targeting crypto wallets like:

• MetaMask (io.metamask)
• Trust (com.wallet.crypto.trustapp)
• Blockchain.com (piuk.blockchain.android)
• Phantom (app.phantom)

Interesting to note that for wallet applications four languages were supported: English, Russian, Czech, Slovakian.

Mode of Attack:

They poses themselves in Play Store adult-friendly version of TikTok (TikTok 18+). And so once the dropper has been installed, it requests more permission for the users from 3rd party to bypass critical security measures by Google.

RatOn was designed, like many modern Android bankers, as a multi-stage process. and distributed by infecting the victim using a dropper. The dropper, which is designed as a third party software installer, will request the permission from the victim to install applications from third party sources. This step is needed to overcome Android restrictions for third party applications to abuse Accessibility services.

https://www.threatfabric.com/blogs/the-rise-of-raton-from-nfc-heists-to-remote-control-and-ats#cryptocurrency_wallet_attacks

[_act_]

It is still the same old method way of downloading malware and the malware will get installed and request for more permissions before it can do its work.

To avoid the malware is also still the old way of not downloading the unnecessary apps. I prefer to download just necessary apps like wallet and exchanges.


Thanks that you posted this, probably newbies can learn from it.

[rdluffy]

Thanks for the warning
I always wonder if crypto users fall for these scams, like the one on TikTok for adults
It's pretty clear that it's not an official app

A basic tip for anyone is to always check if an app is real or not
What I do here before downloading any app is look at the official X profile, Instagram, and even search on Discord if necessary

One thing I see a lot of people doing, and I'm amazed at how unaware they are of the risk they're taking, is downloading apps that promise free movies and TV shows, as well as cracked versions of official apps that require a subscription
They don't know the danger they're in

[Taskford]

Thanks for the warning
I always wonder if crypto users fall for these scams, like the one on TikTok for adults
It's pretty clear that it's not an official app

A basic tip for anyone is to always check if an app is real or not
What I do here before downloading any app is look at the official X profile, Instagram, and even search on Discord if necessary

One thing I see a lot of people doing, and I'm amazed at how unaware they are of the risk they're taking, is downloading apps that promise free movies and TV shows, as well as cracked versions of official apps that require a subscription
They don't know the danger they're in

Actually there is since its sad to say that not everyone think the same with us like, we verify first those things like apps that can confuse us if its real or not.

There are people just download it directly without even thinking that they spot the wrong app.

That's why lots of people still got infected or got hacked by this bad apps.

Also good to see those recommendation you have given, so hopefully people would really do that and don't think about that doing some sort of verification is waste of time. Since there are thousands of fake apps out there spreading waiting for some victim to fall on their traps.

[albon]

It would be foolish to install these cracked apps on a phone that contains crypto wallets, a banking app, and seed phrases.

These apps are not safe, and by granting them these sensitive permissions, they can take complete control of the phone.

The best solution is to purchase a hardware wallet for cold storage or use a separate phone as a testing field.

RatOn has many high-risk functionalities that it can execute on the device, so one must be very cautious not to get infected with such malware. Beginners should take all necessary security measures .

[tech30338]

This is why always update the your system, avoid common ways that this malware are get, like clicking link downloading applications that you don't know, use hardware wallets, and do 2fa's don't open emails from unknown or even from a person you know that seems suspicious since some malware can takeover even in sending a message using you account, so be safe guys.

[Patikno]

Based on the information I received, it turns out that the RatOn attack does not directly attack users, but it exploits user negligence, impersonating the Play Store (fake), disguising itself as TikTok 18+ (as bait for potential victims), and then asking for user permission to install applications from third-party sources (unknown sources). So, I think there are several things we need to pay attention to, namely don't be easily provoked, verify official sources, avoid allowing access from untrusted sources (or installations from untrusted sources), and most importantly, always be skeptical of the information we get, especially if it seems tempting. So I hope we are always vigilant about the information we get, and especially for beginners who are most vulnerable to being provoked and falling into such traps.

Source : thehackernews.com - RatOn Android Malware Detected With NFC Relay and ATS Banking Fraud Capabilities

Apart from that, I also recommend avoiding storing crypto wallets on devices used daily, especially on devices used for various experiments (such as installing unofficial applications), this is very dangerous. I thank the OP for diligently reviewing discussions like this, because this needs to be a warning for all of us.

[Forsyth Jones]

I'll tell you a story that recently happened to someone in my family, my grandmother.

In short, her phone was hacked because she was tricked by a fraudulent advertiser on Facebook (through ads). She was directed to chat with the store via WhatsApp. She was supposedly buying an electric motorcycle.

She gave the fraudster her personal informations. As far as I know, no financial transaction had taken place, but they instructed her to install an app just to track the product. This app was a Trojan that had many permissions, such as microphone, memory, call log, etc.

Soon after, part of her bank account was drained. The crooks even managed to obtain a loan of about $4,000. The case is now with a lawyer trying to reverse everything.

Therefore, instruct older people in your family not to click on suspicious links, much less install anything outside of the Play Store. The same goes for iOS, but it's much more difficult on iOS.

Perhaps iOS is safer for older people simply because it's much harder to install apps outside of the official store, especially if the person isn't very digitally literate.

[Dave1]

I think it's very easy to fall for this trick as the criminals is using *adult* content to attract potential victims.

And from what I read, not just crypto but also banking information are being target by this trojan. So it's a all in one with more sophisticated attacks and that's what make this another dangerous trojan recently found or reported.

We should know the drill by now, malwares and trojans are getting highly advance. It really depends on us to really understand how we could be trap by the hackers. And be self-aware, read also articles about this subject so that we will not be the next victim.

[DubemIfedigbo001]

I feel this would affect the more users who have refused to practice the separation principle and not using the same device both for crypto transactions and normal social activities. Ever since I got a second device and removed my exchange linking emails and exchanges accounts from the former and transferred then to the new device acquired specifically for crypto and banking transactions, I have had no need to worry myself about being hacked since the malwares cannot hijack what they don't have access to.

[btc_angela]

I feel this would affect the more users who have refused to practice the separation principle and not using the same device both for crypto transactions and normal social activities. Ever since I got a second device and removed my exchange linking emails and exchanges accounts from the former and transferred then to the new device acquired specifically for crypto and banking transactions, I have had no need to worry myself about being hacked since the malwares cannot hijack what they don't have access to.

That's why we always suggest is that if you have money to invest, then you should also have money to spend in separating all things crypto as to your personal space. Like in this case, if you have the same device and then you suddenly downloaded this trojan, for sure you will be regret it later.

And as far as using mobile phone, I didn't practice to have a wallet on it. No offense to those who have their Bitcoin wallet or multi-wallet on their phone maybe they're very convenient for them. But for me, it's like I'm not comfortable because I afraid that I might install something that could really affect my wallets in a bad way.

[348Judah]

Mode of Attack:

They poses themselves in Play Store adult-friendly version of TikTok (TikTok 18+). And so once the dropper has been installed, it requests more permission for the users from 3rd party to bypass critical security measures by Google.

RatOn was designed, like many modern Android bankers, as a multi-stage process. and distributed by infecting the victim using a dropper. The dropper, which is designed as a third party software installer, will request the permission from the victim to install applications from third party sources. This step is needed to overcome Android restrictions for third party applications to abuse Accessibility services.

Many would have downloaded and granted them access unknowingly, that is why we needed to be more careful and also selective in choosing on what to download and from where to make this done, because once downloaded, we may not be able to resist that full attack they might aimed on us as they will request for granting of permissions as we are used to in other apps by granting them, not knowing its an attack.

[masulum]

This is why it's important to look beyond the app title/name. A simple tip that may help users to prevented installing fake apps, is to double-check the developer. Even if it's a fake developer using a company name, this can be identified by the apps already uploaded and the app reviews. TikTok isn't a small app, it has millions of users, so user should be able to read plenty of reviews before installed it. However, if user only look at the application title, it will be very easy to be fooled by phishing and malware, considering that applications store, ads platform provider are always become easy place for distribution virus or fake apps/site.

[Yaunfitda]

Mode of Attack:

They poses themselves in Play Store adult-friendly version of TikTok (TikTok 18+). And so once the dropper has been installed, it requests more permission for the users from 3rd party to bypass critical security measures by Google.

RatOn was designed, like many modern Android bankers, as a multi-stage process. and distributed by infecting the victim using a dropper. The dropper, which is designed as a third party software installer, will request the permission from the victim to install applications from third party sources. This step is needed to overcome Android restrictions for third party applications to abuse Accessibility services.

Many would have downloaded and granted them access unknowingly, that is why we needed to be more careful and also selective in choosing on what to download and from where to make this done, because once downloaded, we may not be able to resist that full attack they might aimed on us as they will request for granting of permissions as we are used to in other apps by granting them, not knowing its an attack.

Correct, sometimes when we see something and download it right away without checking. Like in this kind of attack, it's in Play Store and so we think it's safe (although for most of us who has experience already, I don't think we can easily fall for this). And then after that, we have been like a robot that follows every instructions like allowing it to have full control of our mobile phone and granting it like super permission until it's too late. Hopefully, they have been exposed in this kind of attack and crypto enthusiast will just wake up in time and check every app that we download.

[rdluffy]

Actually there is since its sad to say that not everyone think the same with us like, we verify first those things like apps that can confuse us if its real or not.

There are people just download it directly without even thinking that they spot the wrong app.

That's why lots of people still got infected or got hacked by this bad apps.

Also good to see those recommendation you have given, so hopefully people would really do that and don't think about that doing some sort of verification is waste of time. Since there are thousands of fake apps out there spreading waiting for some victim to fall on their traps.

What I always try to do is warn my friends and family never to download anything without researching it first, never to download cracked apps (Android APKs), and never to use unknown Wi-Fi networks
However, practically no one listens to me 

Remember that it's not just cryptos that can be stolen. Nowadays, everyone has banking apps, email with important information, credit cards, etc

I believe that many people have suspicious apps on their cell phones, fall victim to scams, and don't even know that it may have been these fake apps

[sunsilk]

Those people that lacks of knowledge on how to protect themselves and only invested to crypto because of the hype are likely to fall for this.

In as much as we want to warn them, they don't do their research before they download an app and that's why they're the target victims of these apps.

They only look at the logo and doesn't verify and even it's got a lot of downloads, that shouldn't be the basis for them to download those that contains malware and portrays faking others like a genuine one.