Android Banking Trojan for Rent on Dark Web
Security firm SfyLabs has discovered that multiple dark websites are offering a new Android banking trojan called the Red Alert 2.0 for rent at $500 per month.
"The last several months a new actor has been very busy developing and distributing a new Android trojan dubbed 'Red Alert 2.0' by the actor," researchers for SfyLabs revealed through a blog post.
According to the security firm, the banking malware has been offered for rent on numerous online hacking forums in the past few months. In addition, the creators continue upgrading the malware and adding new features.
Get Our Latest News for FREE
SfyLabs indicates that the malware can come in the form of infected apps. As of now, they have targeted over 60 banking and social media apps. Once users download these apps, hackers will be able to steal personal information from their targets.
Like other threats, the Red Alert 2.0 comes with the ability to steal login credentials as well as contact details, hijack text messages, and produce an overlay on legitimate app.
The malware typically launches when infected users access banking or social media apps. Once it is activated, an HTML-based overlay will appear atop the original app. Users will then see an error in logging in and they will be asked to re-authenticate the account. The overlay is responsible for recording the target's personal details that are entered through the touch screen keyboard. The data gathered will then be transferred to the command and control solvers for hackers to use.
The malware is also capable of blocking and logging incoming calls that is related to banks and financial associations. With that in mind, hackers will be able to intercept warnings of a compromised account that financial institutions would send to victims.
SfyLabs indicates that the malware is capable of operating on Android 6.0 Marshmallow and previous versions.
To avoid Red Alert 2.0, tech enthusiasts should opt to download apps from more legitimate sources such as Google Play Store. The malware has yet to be detected on their system.
