Photo: Primakov / Shutterstock.com
Researchers have discovered a widespread malicious campaign targeting Android users in India. The campaign uses over 1,000 malicious apps and live phone numbers to redirect text messages. So far, around 1,000 phone numbers to harvest user information have come to light, and researchers have identified 900 malware samples associated with the campaign, majorly aimed at Indian banks.
Security researchers claim that a single threat actor orchestrates the attacks. Analysis of the collected samples shows shared code structures, user interface elements, and app logos, suggesting that the apps might have originated from a common codebase and single entity.
Zimperium also found over 220 publicly accessible Firebase storage buckets, with 2.5 GB of sensitive information such as SMS messages from banks, government ID data, and card and banking details. Estimates put the number of compromised users at around 50,000.
These apps also include hard-coded phone numbers that receive the extracted OTPs and SMS messages. Tracking the hard-coded phone numbers leads to specific regions in India, such as West Bengal, Bihar, and Jharkhand, all previously known for their scammer or cybercrime activity.
Since malicious apps can’t be hosted on trusted app platforms, especially the Google Play Store. The campaign operators are sidestepping this by using WhatsApp to distribute APK files and impersonate government or banking apps. However, these apps install malware instead, which uses SMS permissions to intercept and extract messages containing sensitive banking information, including OTPs. The malicious apps also hide their icons and prevent users from uninstalling them to maintain persistence on compromised devices.
All the stolen information from these apps is sent to Firebase databases acting as Command and Control servers. To make matters worse, researchers found that the Firebase databases containing this stolen information lack authentication mechanisms, meaning they’re publicly accessible and therefore put anyone’s compromised details in front of the whole internet.
In the News: RBI announces exclusive ‘bank.in’ and ‘fin.in’ domains for extra security
