Google Play app dropped Vultur banking Trojan on Android handsets

A Trojanized 2FA authenticator app has been removed from the Google Play Store. 

The app, 2FA Authenticator, was discovered by the Pradeo security team. 

According to a cached version of the app's page on Google Play, the developer said the software provided a "secure authenticator for your online services, while also including some features missing in existing authenticator apps, like proper encryption and backups."

In addition, the app claimed to support HOTP and TOTP, and was marketed as a way to import other authenticator protocols – including Authy, Google Authenticator, Microsoft Authenticator, and Steam – and host them in one place. 

During its time on Google Play, the app was downloaded and installed over 10,000 times. 

However, the app was less about protecting your data and more about stealing it. According to Pradeo, upon installation, the app would act as a dropper for malware designed to steal financial information. 

"It has been developed to look legitimate and provide a real service," the researchers say. "To do so, its developers used the open-source code of the official Aegis authentication application to which they injected malicious code. As a result, the application is successfully disguised as an authentication tool which ensures it maintains a low profile."

In the first stage of the attack, 2FA Authenticator requests a range of permissions from the handset owner including camera and biometric access, the ability to tamper with system alerts, package querying, and the ability to disable keylock. 

The permissions allow the malware to perform actions including collecting localized data for targeted attacks; disabling keylock and password security, downloading external apps, and creating overlay windows over other mobile application windows. 

Once these permissions have been granted, the dropper then installs Vultur. 

According to Threat Fabric, Vulture is a Remote Access Trojan (RAT) that is a relatively new entrant to the malware landscape. Vultur uses screen recording and keylogging to capture bank account and financial service credentials rather than traditional overlay functions – a slower method, but potentially one that is less likely to be detected. 

Vultur tends to target European banking institutions as well as a range of cryptocurrency wallet platforms. The dropper used to execute the RAT is a framework called Brunhilda, previously linked to Android malware distribution through fake utility and 2FA apps on Google Play. 

In an update, the Pradeo team said the malicious app was removed after being available on the Google Play Store for 15 days. If you try to access the 2FA Authenticator page, you are met with an error display. 

Users of the app are advised to delete the software from their handsets.

ZDNet has reached out to Google and we will update when we hear back.

Previous and related coverage

Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0