New DroidBot Android malware targets 77 banking, crypto apps

A brand new Android banking malware named ‘DroidBot’ makes an attempt to steal credentials for over 77 cryptocurrency exchanges and banking apps within the UK, Italy, France, Spain, and Portugal.

Based on Cleafy researchers who found the brand new Android malware, DroidBot has been lively since June 2024 and operates as a malware-as-a-service (MaaS) platform, promoting the software for $3,000/month.

At the very least 17 affiliate teams have been recognized utilizing malware builders to customise their payloads for particular targets.

Though DroidBot lacks any novel or refined options, evaluation of one in every of its botnets revealed 776 distinctive infections throughout the UK, Italy, France, Turkey, and Germany, indicating a major exercise.

Additionally, Cleafy says the malware seems to be underneath heavy improvement on the time, with indicators of making an attempt growth to new areas, together with Latin America.

The DroidBot MaaS operation

DroidBot’s builders, who look like Turkish, present associates with all of the instruments required to conduct assaults. This contains the malware builder, command and management (C2) servers, and a central administration panel from which they’ll management their operations, retrieve stolen information, and subject instructions.

A number of associates function on the identical C2 infrastructure, with distinctive identifiers assigned to every group, permitting Cleafy to establish 17 risk teams.

The payload builder permits the associates to customise DroidBot to focus on particular purposes, use completely different languages, and set different C2 server addresses.

Associates are additionally offered entry to detailed documentation, help from the malware’s creators, and entry to a Telegram channel the place updates are revealed recurrently.

All in all, the DroidBot MaaS operation makes the barrier of entry pretty low for inexperienced or low-skilled cybercriminals.

Impersonating common apps

DroidBot is usually masqueraded as Google Chrome, Google Play retailer, or ‘Android Safety’ as a approach to trick customers into putting in the malicious app.

Nevertheless, in all circumstances, it acts as a trojan making an attempt to steal delicate info from apps. 

The primary options of the malware are:

• Keylogging – Capturing each keystroke entered by the sufferer.
• Overlaying – Displaying pretend login pages over legit banking app interfaces.
• SMS interception – Hijacks incoming SMS messages, notably these containing one-time passwords (OTPs) for banking sign-ins.
• Digital Community Computing – VNC module provides associates the aptitude to remotely view and management the contaminated system, execute instructions, and darken the display screen to cover the malicious exercise.

A key facet of DroidBot’s operation is the abuse of Android’s Accessibility Providers to observe consumer actions and simulate swipes and faucets on behalf of the malware. Subsequently, in the event you set up an app that requests unusual permissions, just like the Accessibility Providers, it’s best to instantly change into suspicious and deny the request.

Among the many 77 apps DroidBot makes an attempt to steal credentials, some standouts embrace Binance, KuCoin, BBVA, Unicredit, Santander, Metamask, BNP Paribas, Credit score Agricole, Kraken, and Garanti BBVA.

To mitigate this risk, Android customers are suggested to solely obtain apps from Google Play, scrutinize permission requests upon set up, and ensure Play Shield is lively on their gadgets.