A new malware that targets mobile banking apps on Android smartphones has been discovered. The android Trojan known as Brokewell is a banking malware that can both steal data and control a victim’s device.
The malware has the ability to bypass Android restrictions ( even newer Android versions such 13, 14 and 15), and it uses phishing tactics such as fake browser updates as a means to trick targets into downloading and installing a version of the malware.
How it infects victim’s devices & the consequences of getting infected
The infection process begins with the cyber criminals deploying fake browser update pages as phishing attack to lure unsuspecting victims into downloading and installing the malware. Once installed and launched, the victim is prompted to grant permissions to the accessibility service, which is subsequently used to automatically grant other permissions and carry out various malicious activities. These malicious activities include, displaying overlay screens on top of targeted apps to steal banking and other user credentials and more. The criminals can also further record audio, take screen shots, retrieve call logs, access device location, send SMS messages, make phone calls, install and uninstall apps, and disable the accessibility service.
Consequences of the installation of this banking malware.
- Attacker can steal sensitive financial information.
- Attacker can commit financial fraud using victim’s device.
- Financial loss.
- Reputation damage.
- Attackers can monitor the victim’s device in real time and manipulate it through clicks, swipes, and touches.
What is the Solution?
All android phone users should take the following precautionary steps:
- Avoid clicking on suspicious links.
- Be mindful of fake browser or application update pages.
- Ensure that their Android devices and apps are up to date with the latest security patches.
- Download only verified apps from the official Google Play Store.
- Frequently review financial transactions for any unauthorized activity and report same to the bank.
- Periodically scan devices to ensure they are free of malware using reputable antivirus app.
- Always review app permissions before installation of any app.
Definition of Terms
- Malware: A malware is a malicious software / application designed to harm devices or networks.
- Trojan: A Trojan is a type of malware that hides itself in an application and is deployed upon installation and use of the application.
- Phishing: Phising is the use of digital communication methods to trick people into revealing sensitive data or deploying malicious software.
Please Stay Safe Online!
