A fresh alert has been issued to Android users after the discovery that cyber crooks are trying a new scam to access bank accounts.
Anyone with an Android phone in their pocket would be wise to take note of an urgent warning that’s been issued this week. Cyber security experts at FOX IT say they have discovered a worrying new threat targeting Android users and falling for the scam could hand over personal bank details to the hackers.
The fairly elaborate attack all starts with a simple text that is sent through to devices. The message suggests that the user is about to be hit by a massive bank charge and must ring a number immediately to verify the transaction is real. Once the call is made, another text appears asking the user to download and install a version of the popular McAfee security application to stop future issues and attacks from taking place.
A link is provided within the text and once tapped the download begins. Unfortunately, there is no real McAfee access with the scammers using the message to push a fake copy of the security app to devices instead. Once loaded onto the Android platform users are then attacked by the vicious bank-raiding Vultur malware which can hack passwords, spy on screens during logins and gain access to private accounts.
“In order to deceive unsuspecting individuals into installing malware, the threat actors employ a hybrid attack using two SMS messages and a phone call,” FOX IT explained.
“First, the victim receives an SMS message that instructs them to call a number if they did not authorize a transaction involving a large amount of money. A second SMS is sent during the phone call, where the victim is instructed into installing a trojanised version of the McAfee Security app from a link.”
“This dropper decrypts and executes a total of 3 Vultur-related payloads, giving the threat actors total control over the victim’s mobile device.”
It’s clearly a very scary attack but there are some simple ways to avoid becoming the next victim. Firstly, if you receive a text asking you to call the bank, don’t use the number included in the message. Instead, call your financial provider using their official contact details which are usually included on the back of debit cards or via online services.
Next, it’s a good idea to never install any apps from untrusted sources – especially if sent via text message.
If you want to download McAfee software, head to the Google Play Store and install it via this official marketplace. That should mean your phone is kept secure. If you think you may have already been duped, delete the app immediately and call your bank without delay.
“Vultur’s recent developments have shown a shift in focus towards maximizing remote control over infected devices,” FOX IT added. With the capability to issue commands for scrolling, swipe gestures, clicks, volume control, blocking apps from running, and even incorporating file manager functionality, it is clear that the primary objective is to gain total control over compromised devices.”
Tags: Urgent text alert issued Android users check phone avoid costly errors
