Skip to main content

New Malware Strain Targets Android Mobile Banking

Apr 03, 2019
Photo credit: Getty Images/BigNazik

A new generation of malware that targets major banks, e-commerce sites and cryptocurrency services has been identified by Group-IB, a Russian cybersecurity firm.
The malware is known as Gustuff and operates on Android platforms. Group-IB warned that Gustuff can potentially target more than 100 banking apps, including 27 in the U.S.–Bank of America, Bank of Scotland, J.P.Morgan, Wells Fargo, Capital One, TD Bank and PNC Bank were among those cited in Group-IB’s report. Online payment service including PayPal and Western Union, along with cryptocurrency services including Bitcoin Wallet and Coinbase and e-commerce sites eBay and were among other potential targets.
Gustuff uses the Accessibility Service, intended to assist people with disabilities, to spread its digital mischief. Group-IB estimated that the malware was first developed in Russia and has been available since April 2018, and an upgraded version now sells for a monthly subscription in cybercriminal forums for $800.
“After being uploaded to the victim’s phone, the Gustuff uses the Accessibility Service to interact with elements of other apps’ windows including cryptocurrency wallets, online banking apps, messengers etc.,” the Group-IB researchers noted. “The Trojan can perform a number of actions, for example, at the server’s command, Gustuff is able to change the values of the text fields in banking apps. Using the Accessibility Service mechanism means that the Trojan is able to bypass security measures used by banks to protect against older generation of mobile Trojans and changes to Google’s security policy introduced in new versions of the Android OS.
“Moreover,” the researchers added, “Gustuff knows how to turn off Google Protect; according to the Trojan’s developer, this feature works in 70 percent of cases. Gustuff is also able to display fake push notifications with legitimate icons of the apps mentioned above. Clicking on fake push notifications has two possible outcomes: either a web fake downloaded from the server pops up and the user enters the requested personal or payment (card/wallet) details; or the legitimate app that purportedly displayed the push notification opens—and Gustuff at the server’s command and with the help of the Accessibility Service, can automatically fill payment fields for illicit transactions.”

About the author
Apr 03, 2019
More from
Planet Home Lending Welcomes New Executive Vice President And Chief Information Officer

Bill Shuler brings a diverse background in IT leadership and mortgage consulting to the role

May 21, 2024
Automation Attracts Investors Who Love Homogenous Loan Pools

Human-free underwriting promises to expand primary and secondary, non-agency markets

May 02, 2024
Raising An Ai Brainchild In The Mortgage Industry

Angel Ai takes on the next five years with a new ‘do and functions to boot

May 02, 2024
NAR Partners With SoFi

NAR members and their clients can receive exclusive rates and discounts on mortgages, student loan refinancing and personal loans.

Apr 09, 2024
Floify President and GM Advising Broker Action Coalition

Sofia Rossato appointed as a vendor advisor to new non-profit

Apr 03, 2024
How InstaAI Transforms Loan Officers' Efficiency And Performance

By building a first-of-its-kind GenAI solution, InstaMortgage continues to redefine industry standards

May 07, 2024