securityaffairs.co Open in urlscan Pro
2001:8d8:100f:f000::289  Public Scan

Form analysis
1 forms found in the DOM

Name: searchform — GET https://securityaffairs.co/wordpress/

<form role="search" method="get" name="searchform" id="searchform" action="https://securityaffairs.co/wordpress/">
  <div>
    <input type="text" value="" name="s" id="s" autocomplete="off" title="Search..." class="blur">
    <button type="submit">
      <i class="fa fa-search"></i>
    </button>
  </div>
  <div id="autocomplete"></div>
</form>

Text Content

 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me


MUST READ

Headlines
 * MaliBot Android Banking Trojan targets Spain and Italy
 * Chinese DriftingCloud APT exploited Sophos Firewall Zero-Day before it was
   fixed
 * Experts link Hermit spyware to Italian surveillance firm RCS Lab and a front
   company
 * A Microsoft 365 feature can ransom files on SharePoint and OneDriveCould
 * BlackCat Ransomware affiliates target unpatched Microsoft Exchange servers
 * ALPHV/BlackCat ransomware gang starts publishing victims' data on the clear
   web



 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me


MALIBOT ANDROID BANKING TROJAN TARGETS SPAIN AND ITALY

June 18, 2022  By Pierluigi Paganini


Powered by pixfutureⓘ


MALIBOT IS A NEW ANDROID MALWARE TARGETING ONLINE BANKING AND CRYPTOCURRENCY
WALLET CUSTOMERS IN SPAIN AND ITALY.

F5 Labs researchers spotted a new strain of Android malware, named Malibot, that
is targeting online banking and cryptocurrency wallet customers in Spain and
Italy. The experts documented attacks against multiple banks, including
UniCredit, Santander, CaixaBank, and CartaBCC.


Powered by pixfutureⓘ

The malware was discovered two weeks after an international law enforcement
operation dismantled the FluBot malware.

The malware supports a broad range of features, including the ability to steal
credentials, cookies, and bypass multi-factor authentication (MFA) codes. The
malicious code also is also able to remotely control infected devices using a
VNC server implementation

MaliBot disguises itself as a cryptocurrency mining app named “Mining X” or “The
CryptoApp”, experts also observed the malicious code masqueraded as
“MySocialSecurity” and “Chrome” apps.

The experts discovered that the C2 is in Russia and that the malware used the
same servers that were associated with the Sality malware operation. The C2 is
active at least since June of 2020, the malware is a heavily modified re-working
of the SOVA Android banking trojan, but supports different functionality, and
has different targets, C2 servers, domains and packing schemes.

The malware is distributed through malicious websites or via smashing attacks.

“Distribution of MaliBot is performed by attracting victims to fraudulent
websites where they are tricked into downloading the malware, or by directly
sending SMS phishing messages (smishing) to mobile phone numbers.” reads the
advisory published by F5 Labs.

Like other banking Trojan, Malibot abuses the Accessibility Service to
implements a VNC-like functionality using the Accessibility API, grabs
information from screen, and populate bus object which saves device’s states.

“MaliBot listens for events using the Accessibility Service. If it detects that
the victim has opened an app on the list of targets, it will set up a WebView
that displays an HTML overlay to the victim.” continues the report.

Malibot abuses the access to the Accessibility API to bypass Google 2FA methods.

“MaliBot is most obviously a threat to customers of Spanish and Italian banks,
but we can expect a broader range of targets to be added to the app as time goes
on. In addition, the versatility of the malware and the control it gives
attackers over the device mean that it could, in principle, be used for a wider
range of attacks than stealing credentials and cryptocurrency.” concludes the
report. “In fact, any application which makes use of WebView is liable to having
the users’ credentials and cookies stolen.”

Security Affairs is one of the finalists for the best European Cybersecurity
Blogger Awards 2022 – VOTE FOR YOUR WINNERS. I ask you to vote for me again
(even if you have already done it), because this vote is for the final.

Please vote for Security Affairs and Pierluigi Paganini in every category that
includes them (e.g. sections “The Underdogs – Best Personal (non-commercial)
Security Blog” and “The Tech Whizz – Best Technical Blog”)

To nominate, please visit: 

https://docs.google.com/forms/d/e/1FAIpQLSdNDzjvToMSq36YkIHQWwhma90SR0E9rLndflZ3Cu_gVI2Axw/viewform

Follow me on Twitter: @securityaffairs and Facebook



Pierluigi Paganini

(SecurityAffairs – hacking, Malibot)


Powered by pixfutureⓘ



Share this...

Facebook
Twitter
Linkedin


SHARE THIS:

 * Email
 * Twitter
 * Print
 * LinkedIn
 * Facebook
 * More
 * 

 * Tumblr
 * Pocket
 * 
 * 


information security newsIT Information SecurityMalibotmalwarePierluigi
PaganiniSecurity AffairsSecurity News


--------------------------------------------------------------------------------

SHARE ON

 * 
 * 
 * 
 * 
 * 
 * 
 * 


PIERLUIGI PAGANINI

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and
Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he
is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security
expert with over 20 years experience in the field, he is Certified Ethical
Hacker at EC Council in London. The passion for writing and a strong belief that
security is founded on sharing and awareness led Pierluigi to find the security
blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some
major publications in the field such as Cyber War Zone, ICTTF, Infosec Island,
Infosec Institute, The Hacker News Magazine and for many other Security
magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency
and Bitcoin”.




--------------------------------------------------------------------------------

PREVIOUS ARTICLE

Chinese DriftingCloud APT exploited Sophos Firewall Zero-Day before it was fixed


--------------------------------------------------------------------------------





YOU MIGHT ALSO LIKE


CHINESE DRIFTINGCLOUD APT EXPLOITED SOPHOS FIREWALL ZERO-DAY BEFORE IT WAS FIXED

June 17, 2022  By Pierluigi Paganini

EXPERTS LINK HERMIT SPYWARE TO ITALIAN SURVEILLANCE FIRM RCS LAB AND A FRONT
COMPANY

June 17, 2022  By Pierluigi Paganini






 * SPONSORED CONTENT
   
   
 * 


 * PIXFUTURE

 * 


 * DIGGING THE DEEP WEB: EXPLORING THE DARK SIDE OF THE WEB


 * CENTER FOR CYBER SECURITY AND INTERNATIONAL RELATIONS STUDIES


 * SUBSCRIBE SECURITY AFFAIRS NEWSLETTER


 * SECURITYAFFAIRS AWARDED AS BEST EUROPEAN CYBERSECURITY TECH BLOG AT EUROPEAN
   CYBERSECURITY BLOGGER AWARDS




More Story

CHINESE DRIFTINGCLOUD APT EXPLOITED SOPHOS FIREWALL ZERO-DAY BEFORE IT WAS FIXED

China-linked threat actors exploited the zero-day flaw CVE-2022-1040 in Sophos
Firewall weeks before it was fixed by the security...
Copyright 2021 Security Affairs by Pierluigi Paganini All Right Reserved.
Back to top
 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me

We use cookies on our website to give you the most relevant experience by
remembering your preferences and repeat visits. By clicking “Accept All”, you
consent to the use of ALL the cookies. However, you may visit "Cookie Settings"
to provide a controlled consent.
Cookie SettingsAccept All
Manage consent
Close

PRIVACY OVERVIEW

This website uses cookies to improve your experience while you navigate through
the website. Out of these cookies, the cookies that are categorized as necessary
are stored on your browser as they are essential for the working of basic
functionalities...
Necessary
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly.
This category only includes cookies that ensures basic functionalities and
security features of the website. These cookies do not store any personal
information.
Non-necessary
Non-necessary
Any cookies that may not be particularly necessary for the website to function
and is used specifically to collect user personal data via analytics, ads, other
embedded contents are termed as non-necessary cookies. It is mandatory to
procure user consent prior to running these cookies on your website.
SAVE & ACCEPT