Attackers are combining credential phishing, credit card data theft, and malware into a single campaign targeting banking details.
While it's common to see attacks involving phishing or malware, the combination of these tactics in a single campaign targeting Android devices of financial services and banking customers indicates the extent to which attackers are willing to play a more extended game to get to their goal.
The attacks combine phishing with the distribution of the Marcher Android trojan, a form of banking malware which has been active since at least late 2013. Lures previously used to distribute Marcher include a fake software update, a fake security update, and a fake mobile game.
Marcher first originated on Russian underground forums but has since become a global threat, with the trojan targeting bank customers around the world.
Uncovered by researchers at Proofpoint, the latest Marcher campaign has been ongoing since January and uses a multistep scheme to target customers of Austrian banks.
The attacks begin with phishing emails containing a shortened bit.ly link to a fake version of the Bank Austria login page, which has been registered to some different domains containing 'bankaustria' in the title, to trick the user into believing they're visiting the official site.
Those who visit the fake Bank Austria page are asked for their customer details, following which they are asked for their email address and phone number. These details provide the attackers with everything they need to move onto using social engineering to conduct the next stage of the campaign.
Using the stolen information, the attackers send the users a warning in a message featuring Bank Austria branding which claims the target doesn't have the "Bank Austria Security App" installed on their smartphone.
The message claims EU money laundering guidelines mean that the new Bank Austria app is mandatory for customers and that failure to install it will lead to the account being blocked. The user is directed to a shortened URL and with the claim that following the link will lead to the installation of the app.
Those who click through to this are provided with additional instructions on how to download the app. The directions say that the user needs to alter their security settings to allow the download of applications from unknown sources. This is a part of the Android ecosystem which attackers regularly exploit to install malware, which in this case enables the installation of Marcher.
The fake app requires extensive permissions including writing and reading external storage, access to precise location, complete control over SMS messages, the ability to read contact data, the ability to read and write system settings, the ability to lock the device and more.
Once fully installed, the malware places a legitimate looking icon on the phone's home screen, again using branding stolen from Bank Austria.
But this version of Marcher isn't just a banking trojan; it also enables the direct theft of credit card details. Those who've installed Marcher are asked for their credit card information when they open applications such as the Google Play store.
The attackers also ask for information including date of birth, address, and password to ensure they have all the data they require to exploit the stolen credentials fraudulently. Each of the overlays is designed to look official via the use of stolen branding.
Data suggests almost 20,000 people clicked through to the campaign, potentially handing their banking details and personal information into the hands of hackers. Similar attacks have also started targeting Raiffeisen and Sparkasse banks.
To avoid falling victim to this type of campaign, users should be wary of unusual domains in general and should be skeptical of any email communication from a bank asking for any sort of credentials. Users should also be wary of downloading apps from unofficial sources which ask for extensive permissions.
While it's common to see attacks involving phishing or malware, the combination of these tactics in a single campaign targeting Android devices of financial services and banking customers indicates the extent to which attackers are willing to play a more extended game to get to their goal.
The attacks combine phishing with the distribution of the Marcher Android trojan, a form of banking malware which has been active since at least late 2013. Lures previously used to distribute Marcher include a fake software update, a fake security update, and a fake mobile game.
Marcher first originated on Russian underground forums but has since become a global threat, with the trojan targeting bank customers around the world.
Uncovered by researchers at Proofpoint, the latest Marcher campaign has been ongoing since January and uses a multistep scheme to target customers of Austrian banks.
The attacks begin with phishing emails containing a shortened bit.ly link to a fake version of the Bank Austria login page, which has been registered to some different domains containing 'bankaustria' in the title, to trick the user into believing they're visiting the official site.
Those who visit the fake Bank Austria page are asked for their customer details, following which they are asked for their email address and phone number. These details provide the attackers with everything they need to move onto using social engineering to conduct the next stage of the campaign.
Using the stolen information, the attackers send the users a warning in a message featuring Bank Austria branding which claims the target doesn't have the "Bank Austria Security App" installed on their smartphone.
The message claims EU money laundering guidelines mean that the new Bank Austria app is mandatory for customers and that failure to install it will lead to the account being blocked. The user is directed to a shortened URL and with the claim that following the link will lead to the installation of the app.
Those who click through to this are provided with additional instructions on how to download the app. The directions say that the user needs to alter their security settings to allow the download of applications from unknown sources. This is a part of the Android ecosystem which attackers regularly exploit to install malware, which in this case enables the installation of Marcher.
The fake app requires extensive permissions including writing and reading external storage, access to precise location, complete control over SMS messages, the ability to read contact data, the ability to read and write system settings, the ability to lock the device and more.
Once fully installed, the malware places a legitimate looking icon on the phone's home screen, again using branding stolen from Bank Austria.
But this version of Marcher isn't just a banking trojan; it also enables the direct theft of credit card details. Those who've installed Marcher are asked for their credit card information when they open applications such as the Google Play store.
The attackers also ask for information including date of birth, address, and password to ensure they have all the data they require to exploit the stolen credentials fraudulently. Each of the overlays is designed to look official via the use of stolen branding.
Data suggests almost 20,000 people clicked through to the campaign, potentially handing their banking details and personal information into the hands of hackers. Similar attacks have also started targeting Raiffeisen and Sparkasse banks.
To avoid falling victim to this type of campaign, users should be wary of unusual domains in general and should be skeptical of any email communication from a bank asking for any sort of credentials. Users should also be wary of downloading apps from unofficial sources which ask for extensive permissions.
RSS Feed
