Cybersecurity companies this week shared information about new and updated banking trojans targeting users worldwide.
These types of malware can enable their operators to phish credentials, steal sensitive user data, and remotely control compromised devices.
Manic
ThreatFabric has detailed Manic, described as an Android malware that combines banking trojan and spyware capabilities.
The malware has mainly been used against Ukraine, including banks, government services, and messaging applications. However, it has also been observed targeting Russian and European financial institutions, global cryptocurrency and fintech services, and military-focused messaging apps.
Distributed via malicious websites and droppers, the malware enables attackers to log keystrokes, display phishing screens, and remotely control the compromised phone for banking and cryptocurrency fraud.
In addition, Manic includes spyware capabilities such as notification monitoring, location tracking, file harvesting, and remote device surveillance.
“A particularly distinctive capability is its offline mesh relay, which allows collected data to move through nearby infected devices over Wi-Fi Direct or Bluetooth when direct C2 access is unavailable,” ThreatFabric noted.
Grandoreiro
The Acronis Threat Research Unit warned that the Grandoreiro banking trojan remains active, continuing to focus on users in Latin America.
Grandoreiro was also seen targeting Europe last year, and it continues to target Europe alongside North America. However, a recent campaign monitored by Acronis saw the bulk of attacks aimed at Mexico.
The Windows malware, of Brazilian origin, has been around for a decade, and it has continued to improve despite law enforcement’s attempts to disrupt it.
Recent samples abuse the legitimate Duplicate Files Finder (DFF) application to execute malicious code through DLL sideloading. This allows the malware to blend with regular software activity and avoid detection.
“The initial sample incorporates extensive anti-analysis functionality, including sandbox detection, virtual machine artifact checks, process blacklisting and environment profiling designed to evade automated analysis systems,” Acronis explained. “These checks are performed before any attempt to contact the command-and-control (C2) infrastructure, suggesting that avoiding analysis is a high priority for the operators.”
ToxicPanda 2.0
Mobile security firm Zimperium has issued a warning over an updated variant of ToxicPanda, which is known to mainly target Europe.
The Android banking trojan’s latest version introduces significant changes, including support for 167 remote commands and a target list of nearly 350 financial applications; previous versions targeted only 16 apps.
ToxicPanda 2.0 is designed to target financial institutions across 16 countries, including Pakistan, South Africa, Mexico, Nigeria, India, Indonesia, and Panama.
“The malware also introduces an automated click-based mechanism to abuse Android Wireless Debugging (ADB), enabling privilege escalation and shell-level access on compromised devices,” Zimperium explained.
It added, “The updated campaign also reveals a shift in distribution methods, with ToxicPanda 2.0 samples being delivered through Amazon AWS-hosted buckets, indicating the attackers are leveraging cloud infrastructure for malware delivery.”
Related: Rust Supply Chain Attack Linked to North Korean Hackers
Related: AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions
Related: Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset
