McAfee Labs

New Android Malware Found in 144 GooglePlay Apps

McAfee’s Mobile Research team has found a new Android malware in 144 “Trojanized” applications on Google Play. We named this threat Grabos because we found this string in several elements of the code, including variable and method names. Grabos was initially found in the Android application “Aristotle Music audio player 2017,” which claimed to be …

McAfee Labs

Android Banking Trojan Asks for Selfie With Your ID

In the first half of 2016 we noticed that Android banking Trojans had started to improve their phishing overlays on legitimate financial apps to ask for more information. Victims were requested to provide “Mother’s Maiden Name,” “Father’s Middle Name,” “Maternal Grandmothers Name,” or a “Memorable Word.” Attackers used that data to respond to security questions and obtain …

McAfee Labs

iBanking Mobile Trojan Poses as Facebook Token Generator

Mobile banking Trojans have usually pretended to be security applications (for example, Zitmo) or legitimate banking apps (FakeToken or FkSite a.k.a. Perkele) to trick users into installing the malware. These apps steal incoming SMS messages that could contain mTANs (Mobile Transaction Authentication Numbers) used as two-factor authentication to allow Internet transactions. Now, however, it seems that …

McAfee Labs

Android Malware Promises Video While Stealing Contacts

Recently we discovered a new Android Trojan in the official Google Play market that displays a video downloaded from the Internet–but only if some sensitive information is previously sent to a remote server. The malicious applications are designed for Japanese users and display “trailers” of upcoming video games for Android. Here’s one example: Or anime/adult …

McAfee Labs

Google Code Projects Host Android Malware

[March 1: See update at end] Google Code is a well-known platform that provides a collaborative environment for developers working on open source projects. It’s also a target for malware developers. Contrary to what you may think, this is not the first time that Google Code has been used to spread or store malware. (You …

McAfee Labs

Satanbot Employs VBScript to Create Botnet

Malware is on the rise. At the beginning of 2008, our malware collection had 10 million samples. Today we have already surpassed 70 million. Most of the malicious samples are Trojans (backdoors, downloaders, fake alerts), but there are also a lot of viruses, worms, and bots that in a short time can infect many computers …

McAfee Labs

I Smell a RAT: Java Botnet Found in the Wild

Most of today’s malware works on Windows and its apps, because it can affect a lot of people around the world. However, other platforms are becoming more popular every day and attracting bad guys who are starting to create malicious code for other systems. (For a few examples, see BlackHoleRAT, HellRaiser RAT, and a fake-alert …

McAfee Labs

Xirtem Worm Hides in CAB/SFX Files

W32/Xirtem@@MM is a fast-spreading and active worm, discovered in late 2008, that uses a variety of methods to propagate. The principal way of infecting other machines is by sending a copy of itself via email. To do that, the malware uses its own SMTP client. In addition, one of the most well-known methods employed by …