“Sneaky” new Android malware takes over your phone, hiding in fake news and ID apps

Researchers at Cyfirma have investigated Android Trojan capable of stealing data by masquerading as trusted apps, such as a news reader or digital ID apps, tricking users into downloading it. According to Cyfirma, once installed the malware avoids detection, requests Accessibility Services permissions and adds itself as a Device Administrator app, enabling it to read screens, tap buttons and autofill forms.

It also overlays fake login screens on top of real banking and cryptocurrency apps to capture credentials and can send back device information to a remote command centre while receiving updated instructions to evade traces. The malware silences notifications to remain unseen and, according to Malwarebytes, targets banking users in Southeast Asia, with the potential to spread elsewhere. Malwarebytes notes the threat is detected as Android/Trojan.Spy[.]Banker.AUR9b9b491bC44.

To stay safe, users are advised to download apps only from trusted sources, review requested permissions carefully and keep security software and devices up to date.