NCC Notifies Nigerians of an app stealing banking app details

NCC Notifies Nigerians of an app stealing banking app details

NCC Notifies Nigerians of an app stealing banking app details

According to the Nigerian Communications Commission’s Computer Security Incident Response Team, dangerous software has been detected on Android smartphones that steals users’ banking app login credentials. The team has issued a warning to Nigerians about the malware.

Following the findings of the European Commission, a malicious software program known as ‘Xenomorph,’ which has been discovered to target 56 financial institutions throughout Europe, has both high impact and a high vulnerability rate.

In addition, the report said that the primary goal of this malware was to steal credentials via the use of SMS and notification interception to log-in and potentially steal two-factor authentication tokens, among other things.

In a statement, NCC said:

“Xenomorph is propagated by an application that was slipped into Google Play store and masquerading as a legitimate application called ‘Fast Cleaner’ ostensibly meant to clear junk, increase device speed and optimise battery.

“In reality, this app is only a means by which the Xenomorph Trojan could be propagated easily and efficiently. To avoid early detection or being denied access to the PlayStore, ‘Fast Cleaner’ was disseminated before the malware was placed on the remote server, making it hard for Google to determine that such an app is being used for malicious actions.

“Once up and running on a victim’s device, Xenomorph can harvest device information and Short Messaging Service, intercept notifications and new SMS messages, perform overlay attacks, and prevent users from uninstalling it. The threat also asks for Accessibility Services privileges, which allow it to grant itself further permissions.”

Based on information provided by the commission’s Cyber Security and Investigations Response Team, malware stole victims’ banking credentials by overlaying fake login pages on top of legitimate ones. Because the malware could intercept messages and notifications, it allowed its operators to bypass SMS-based two-factor authentication and log into the victims’ accounts without their knowledge, the commission said.

On the other hand, the CSIRT security advisory stated that Xenomorph has been discovered to target 56 internet banking apps: 28, which are from Spain, 12, which are from Italy; 9, which are from Belgium; and 7, which are from Portugal; as well as cryptocurrency wallets and general-purpose applications such as emailing services.

According to the NCC, despite the fact that the Fast Cleaner software has been deleted from the Google Play Store, it has had more than 50,000 downloads.


Be the first to comment

Leave a Reply

Your email address will not be published.