[et_pb_section fb_built=”1″ _builder_version=”4.25.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_row column_structure=”1_5,3_5,1_5″ disabled_on=”on|off|off” _builder_version=”4.25.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”1_5″ _builder_version=”4.25.2″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_column][et_pb_column type=”3_5″ _builder_version=”4.25.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https:\/\/intercettazioni.biz\/wp-content\/uploads\/2023\/01\/Banking-trojan.jpg” alt=”Nuovo banking trojan” title_text=”Banking trojan” _builder_version=”4.27.0″ _module_preset=”default” box_shadow_style=”preset2″ global_colors_info=”{}”][\/et_pb_image][et_pb_text _builder_version=”4.27.0″ _module_preset=”default” text_font=”Roboto Condensed||||||||” text_font_size=”18px” global_colors_info=”{}”]<\/p>\n
New problems for Android users that also affect Italy, a well-known hacker has developed a new banking trojan with Remote Access Tooling (RAT) capabilities.<\/span><\/span><\/span><\/strong><\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.0″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n The author of the Android banking trojans, BlackRock and ERMAC has conceived another malware called Hook that introduces new features to access files stored on devices and create a remote interactive session.<\/span><\/span> <\/span><\/span><\/span><\/p>\n ThreatFabric (a Dutch cybersecurity company), in a report shared with The Hacker News, described Hook as a new offshoot of ERMAC even if it has “all the capabilities of its predecessor”, it is advertised for sale at $ 7,000 per month.<\/span><\/span> <\/span><\/span><\/span><\/p>\n \u201cIt also adds Remote Access Tooling (RAT) capabilities to its suite, aligning itself with Trojans such as Octo and Hydra, which are capable of performing a complete Device Take Over (DTO) and completing an entire fraud chain, starting with a leak of personal information and ending with the transaction, with all the intermediate steps, without the need for additional channels,\u201d the Dutch cybersecurity firm said.<\/span><\/span><\/span><\/p>\n The majority of financial apps targeted by the malware are located in the United States, Spain, Australia, Poland, Canada, Turkey, the United Kingdom, France, Italy and Portugal.<\/span><\/span> <\/span><\/span><\/span><\/p>\n Hook is the work of a hacker known as DukeEugene and represents, as we said, the latest evolution of ERMAC, which was first disclosed in September 2021 and is based on another trojan called Cerberus whose source code was discovered in 2020. <\/span><\/span><\/span><\/p>\n \u201cERMAC has always been a step behind Hydra and Octo in terms of capabilities and features,\u201d ThreatFabric researcher Dario Durando told The Hacker News in an email.<\/span><\/span> \u201cThis is also known among hackers, who prefer those two trojans over ERMAC.\u201d<\/span><\/span><\/span><\/p>\n \u201cThe lack of a RAT functionality is a big problem for a modern Android Banker, as it does not offer the ability to perform a Device Take Over (DTO), which is the fraud method that is most likely to succeed and go undetected by fraud scoring engines or fraud analysts.<\/span><\/span> This is most likely what triggered the development of this new malware variant.\u201d<\/span><\/span> <\/span><\/span><\/span><\/p>\n Like other Android malware of this ilk, Hook uses Android\u2019s Accessibility Services API to conduct overlay attacks and collect all sorts of sensitive information such as contacts, call logs, keystrokes, two-factor authentication (2FA) tokens, and even WhatsApp messages.<\/span><\/span> <\/span><\/span><\/span><\/p>\n It also features an expanded list of apps that include ABN AMRO and Barclays, while the malicious packages themselves masquerade as Google Chrome web browsers to trick unsuspecting users into downloading the malware: <\/span><\/span><\/span><\/p>\n \u2022 lojibiwawajinu.guna <\/span><\/span><\/span><\/p>\n \u2022 damariwonomiwi.docebi <\/span><\/span><\/span><\/p>\n \u2022 yecomevusaso.pisifo <\/span><\/span><\/span><\/p>\n Other key features that Hook possesses include the ability to remotely view and interact with the infected device\u2019s screen, obtain files, extract seed phrases* from crypto wallets, and track the phone\u2019s location, blurring the line between spyware and banking malware.<\/span><\/span> <\/span><\/span><\/span><\/p>\n ThreatFabric said that Hook artifacts observed in testing so far could be delivered via phishing campaigns, Telegram channels, or as Google Play Store app droppers.<\/span><\/span> <\/span><\/span><\/span><\/p>\n \u201cThe main downside of creating new malware is usually gaining trust from other attackers, but with DukeEugene\u2019s track record among criminals, that will likely not be a problem for Hook,\u201d Durando said.<\/span><\/span> <\/span><\/span><\/span><\/p>\n <\/span><\/span><\/span><\/p>\n *Seed phrase is a series of words that allow you to generate or regenerate the key tree, which gives you access to your cryptocurrency wallet<\/span><\/span><\/span><\/p>\n [\/et_pb_text][\/et_pb_column][et_pb_column type=”1_5″ _builder_version=”4.25.2″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”1_5,3_5,1_5″ disabled_on=”off|on|on” _builder_version=”4.25.2″ _module_preset=”default” width=”98%” global_colors_info=”{}”][et_pb_column type=”1_5″ _builder_version=”4.25.2″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_column][et_pb_column type=”3_5″ _builder_version=”4.25.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https:\/\/intercettazioni.biz\/wp-content\/uploads\/2023\/01\/Banking-trojan.jpg” alt=”Nuovo banking trojan” title_text=”Banking trojan” _builder_version=”4.27.4″ _module_preset=”default” hover_enabled=”0″ global_colors_info=”{}” custom_padding=”|30px|||false|false” sticky_enabled=”0″][\/et_pb_image][et_pb_text _builder_version=”4.27.0″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n New problems for Android users that also affect Italy, a well-known hacker has developed a new banking trojan with Remote Access Tooling (RAT) capabilities.<\/span><\/span><\/span><\/strong><\/strong><\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.0″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n The author of the Android banking trojans, BlackRock and ERMAC has conceived another malware called Hook that introduces new features to access files stored on devices and create a remote interactive session.<\/span><\/span> <\/span><\/span><\/span><\/p>\n ThreatFabric (a Dutch cybersecurity company), in a report shared with The Hacker News, described Hook as a new offshoot of ERMAC even if it has “all the capabilities of its predecessor”, it is advertised for sale at $ 7,000 per month.<\/span><\/span> <\/span><\/span><\/span><\/p>\n \u201cIt also adds Remote Access Tooling (RAT) capabilities to its suite, aligning itself with Trojans such as Octo and Hydra, which are capable of performing a complete Device Take Over (DTO) and completing an entire fraud chain, starting with a leak of personal information and ending with the transaction, with all the intermediate steps, without the need for additional channels,\u201d the Dutch cybersecurity firm said.<\/span><\/span><\/span><\/p>\n The majority of financial apps targeted by the malware are located in the United States, Spain, Australia, Poland, Canada, Turkey, the United Kingdom, France, Italy and Portugal.<\/span><\/span> <\/span><\/span><\/span><\/p>\n Hook is the work of a hacker known as DukeEugene and represents, as we said, the latest evolution of ERMAC, which was first disclosed in September 2021 and is based on another trojan called Cerberus whose source code was discovered in 2020. <\/span><\/span><\/span><\/p>\n \u201cERMAC has always been a step behind Hydra and Octo in terms of capabilities and features,\u201d ThreatFabric researcher Dario Durando told The Hacker News in an email.<\/span><\/span> \u201cThis is also known among hackers, who prefer those two trojans over ERMAC.\u201d<\/span><\/span><\/span><\/p>\n \u201cThe lack of a RAT functionality is a big problem for a modern Android Banker, as it does not offer the ability to perform a Device Take Over (DTO), which is the fraud method that is most likely to succeed and go undetected by fraud scoring engines or fraud analysts.<\/span><\/span> This is most likely what triggered the development of this new malware variant.\u201d<\/span><\/span> <\/span><\/span><\/span><\/p>\n Like other Android malware of this ilk, Hook uses Android\u2019s Accessibility Services API to conduct overlay attacks and collect all sorts of sensitive information such as contacts, call logs, keystrokes, two-factor authentication (2FA) tokens, and even WhatsApp messages.<\/span><\/span> <\/span><\/span><\/span><\/p>\n It also features an expanded list of apps that include ABN AMRO and Barclays, while the malicious packages themselves masquerade as Google Chrome web browsers to trick unsuspecting users into downloading the malware: <\/span><\/span><\/span><\/p>\n \u2022 lojibiwawajinu.guna <\/span><\/span><\/span><\/p>\n \u2022 damariwonomiwi.docebi <\/span><\/span><\/span><\/p>\n \u2022 yecomevusaso.pisifo <\/span><\/span><\/span><\/p>\n Other key features that Hook possesses include the ability to remotely view and interact with the infected device\u2019s screen, obtain files, extract seed phrases* from crypto wallets, and track the phone\u2019s location, blurring the line between spyware and banking malware.<\/span><\/span> <\/span><\/span><\/span><\/p>\n ThreatFabric said that Hook artifacts observed in testing so far could be delivered via phishing campaigns, Telegram channels, or as Google Play Store app droppers.<\/span><\/span> <\/span><\/span><\/span><\/p>\n \u201cThe main downside of creating new malware is usually gaining trust from other attackers, but with DukeEugene\u2019s track record among criminals, that will likely not be a problem for Hook,\u201d Durando said.<\/span><\/span> <\/span><\/span><\/span><\/p>\n <\/span><\/span><\/span><\/p>\n *Seed phrase is a series of words that allow you to generate or regenerate the key tree, which gives you access to your cryptocurrency wallet<\/span><\/span><\/span><\/p>\n [\/et_pb_text][\/et_pb_column][et_pb_column type=”1_5″ _builder_version=”4.25.2″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":" New problems for Android users that also affect Italy, a well-known hacker has developed a new banking trojan with Remote Access Tooling (RAT) capabilities.The author of the Android banking trojans, BlackRock and ERMAC has conceived another malware called Hook that introduces new features to access files stored on devices and create a remote interactive session. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[96],"tags":[],"class_list":["post-12912","post","type-post","status-publish","format-standard","hentry","category-articles"],"permalink_manager":null,"_links":{"self":[{"href":"https:\/\/intercettazioni.biz\/en\/wp-json\/wp\/v2\/posts\/12912","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/intercettazioni.biz\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/intercettazioni.biz\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/intercettazioni.biz\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/intercettazioni.biz\/en\/wp-json\/wp\/v2\/comments?post=12912"}],"version-history":[{"count":12,"href":"https:\/\/intercettazioni.biz\/en\/wp-json\/wp\/v2\/posts\/12912\/revisions"}],"predecessor-version":[{"id":15955,"href":"https:\/\/intercettazioni.biz\/en\/wp-json\/wp\/v2\/posts\/12912\/revisions\/15955"}],"wp:attachment":[{"href":"https:\/\/intercettazioni.biz\/en\/wp-json\/wp\/v2\/media?parent=12912"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/intercettazioni.biz\/en\/wp-json\/wp\/v2\/categories?post=12912"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/intercettazioni.biz\/en\/wp-json\/wp\/v2\/tags?post=12912"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}