Hackers Put Android Malware Up for Sale That Steals Bitcoins

A new Android malware targeting banking apps and cryptocurrency wallets has appeared for sale on hacker forums. ThreatFabric analysts сообщили.

The Alien malware is based on the source code of the well-known Cerberus banking trojan, which recently began circulating for free. Technically, this malware is more advanced than its predecessor, as it can provide hackers remote access to the infected device.

Alien is capable of stealing passwords from 226 mobile apps, stealing credentials and two-factor authentication codes, intercepting keystrokes, collecting geolocation data, locking the screen, forwarding calls and sending SMS.

“Once a device is infected, hackers steal the contact list, which they then use to propagate the malware further,” ThreatFabric experts said.

Most of the banking apps targeted by the Alien developers belong to financial institutions in Spain, Turkey, Germany, the United States, Italy, France, Poland, Australia and the United Kingdom.

ThreatFabric analysts note that Alien’s distribution methods may vary. In addition to hacker forums, the malware can be hosted on phishing sites and even in Google Play.

Infected Alien apps reveal themselves by requesting administrator rights or access to the accessibility service.

Earlier this year, hackers modified the Cerberus trojan to intercept Google Authenticator passwords. Cerberus subsequently ceased to exist after Google’s security team found a way to detect and clean infected devices.

In early September, recorded several malware attacks with the new Anubis malware designed to steal keys from cryptocurrency wallets.

Subscribe to ForkLog news on Telegram: ForkLog Feed — the full news stream, ForkLog — the most important news and polls.