UBEL is the New Oscorp — Android Credential Stealing Malware Active in the Wild

An Android malware that was observed abusing accessibility services in the device to hijack user credentials from European banking applications has morphed into an entirely new botnet as part of a renewed campaign that began in May 2021.

Italy's CERT-AGID, in late January, disclosed details about Oscorp, a mobile malware developed to attack multiple financial targets with the goal of stealing funds from unsuspecting victims. Its features include the ability to intercept SMS messages and make phone calls and perform Overlay Attacks for more than 150 mobile applications by making use of lookalike login screens to siphon valuable data.

The malware was distributed through malicious SMS messages, with the attacks often conducted in real-time by posing as bank operators to dupe targets over the phone and surreptitiously gain access to the infected device via WebRTC protocol and ultimately conduct unauthorized bank transfers. While no new activities were reported since then, it appears that Oscorp may have staged a return after a temporary hiatus in the form of an Android botnet known as UBEL.

"By analyzing some related samples, we found multiple indicators linking Oscorp and UBEL to the same malicious codebase, suggesting a fork of the same original project or just a rebrand by other affiliates, as its source-code appears to be shared between multiple [threat actors]," Italian cybersecurity company Cliffy said Tuesday, charting the malware's evolution.

Advertised on underground forums for $980, UBEL, like its predecessor, requests for intrusive permissions that allows it to read and send SMS messages, record audio, install and delete applications, launch itself automatically after system boot, and abuse accessibility services on Android to amass sensitive information from the device such as login credentials and two-factor authentication codes, the results of which are exfiltrated back to a remote server.

Once downloaded on the device, the malware attempts to install itself as a service and hide its presence from the target, thereby achieving persistence for extended periods of time.

Interestingly, the use of WebRTC to interact with the compromised Android phone in real-time circumvents the need to enroll a new device and take over an account to perform fraudulent activities.

"The main goal for this [threat actor] by using this feature, is to avoid a 'new device enrollment', thus drastically reducing the possibility of being flagged 'as suspicious' since device's fingerprinting indicators are well-known from the bank's perspective," the researchers said.

The geographical distribution of banks and other apps targeted by Oscorp consists of Spain, Poland, Germany, Turkey, the U.S., Italy, Japan, Australia, France, and India, among others.

Found this article interesting? Follow THN on Facebook, Twitter  and LinkedIn to read more exclusive content we post.