New Android Malware Now Steals Passwords For Non-Banking Apps Too

BlackRock does the data collection by abusing Android's Accessibility Service privileges, for which it seeks users' permissions under the guise of fake Google updates when it's launched for the first time on the device, as shown in the shared screenshots.

Subsequently, it goes on to grant itself additional permissions and establish a connection with a remote command-and-control (C2) server to carry out its malicious activities by injecting overlays atop the login and payment screens of the targeted apps.

These credential-stealing overlays have been found on banking apps operating in Europe, Australia, the US, and Canada, as well as shopping, communication, and business apps.

"The target list of non-financial apps contains famous applications such as but not limited to Tinder, TikTok, PlayStation, Facebook, Instagram, Skype, Snapchat, Twitter, Grinder, VK, Netflix, Uber, eBay, Amazon, Reddit and Tumblr," the researchers told The Hacker News.

This is not the first time mobile malware has abused Android's accessibility features.

Earlier this year, IBM X-Force researchers detailed a new TrickBot campaign, called TrickMo, that was found exclusively targeting German users with malware that misused accessibility features to intercept one-time passwords (OTP), mobile TAN (mTAN), and pushTAN authentication codes.

Then in April, Cybereason uncovered a different class of banking malware known as EventBot that leveraged the same feature to exfiltrate sensitive data from financial applications, read user SMS messages, and hijack SMS-based two-factor authentication codes.

What makes BlackRock's campaign different is the sheer breadth of the applications targeted, which go beyond the mobile banking apps that are typically singled out.

"After Alien, Eventbot, and BlackRock we can expect that financially motivated threat actors will build new banking Trojans and continue improving the existing ones," ThreatFabric researchers concluded.

"With the changes that we expect to be made to mobile banking Trojans, the line between banking malware and spyware becomes thinner, [and] banking malware will pose a threat for more organizations."