New Malware Strain Targets Android Mobile Banking – NMP Skip to main content

New Malware Strain Targets Android Mobile Banking

Phil Hall
Apr 03, 2019
Photo credit: Getty Images/BigNazik

A new generation of malware that targets major banks, e-commerce sites and cryptocurrency services has been identified by Group-IB, a Russian cybersecurity firm.
The malware is known as Gustuff and operates on Android platforms. Group-IB warned that Gustuff can potentially target more than 100 banking apps, including 27 in the U.S.–Bank of America, Bank of Scotland, J.P.Morgan, Wells Fargo, Capital One, TD Bank and PNC Bank were among those cited in Group-IB’s report. Online payment service including PayPal and Western Union, along with cryptocurrency services including Bitcoin Wallet and Coinbase and e-commerce sites eBay and were among other potential targets.
Gustuff uses the Accessibility Service, intended to assist people with disabilities, to spread its digital mischief. Group-IB estimated that the malware was first developed in Russia and has been available since April 2018, and an upgraded version now sells for a monthly subscription in cybercriminal forums for $800.
“After being uploaded to the victim’s phone, the Gustuff uses the Accessibility Service to interact with elements of other apps’ windows including cryptocurrency wallets, online banking apps, messengers etc.,” the Group-IB researchers noted. “The Trojan can perform a number of actions, for example, at the server’s command, Gustuff is able to change the values of the text fields in banking apps. Using the Accessibility Service mechanism means that the Trojan is able to bypass security measures used by banks to protect against older generation of mobile Trojans and changes to Google’s security policy introduced in new versions of the Android OS.
“Moreover,” the researchers added, “Gustuff knows how to turn off Google Protect; according to the Trojan’s developer, this feature works in 70 percent of cases. Gustuff is also able to display fake push notifications with legitimate icons of the apps mentioned above. Clicking on fake push notifications has two possible outcomes: either a web fake downloaded from the server pops up and the user enters the requested personal or payment (card/wallet) details; or the legitimate app that purportedly displayed the push notification opens—and Gustuff at the server’s command and with the help of the Accessibility Service, can automatically fill payment fields for illicit transactions.”

Apr 03, 2019
More from
Zillow Group Lays Off 55 In Texas

Layoffs related to the closing of its Zillow Offers ibuying unit.

Industry News
Jun 29, 2022
'A Tough, Horrible Day For Everybody' At FGMC

First Guaranty Mortgage Corp laid off more than 400 during online meeting.

Industry News
Jun 28, 2022
Mortgage Tech Firms Sales Boomerang, Mortgage Coach Merge

Appoint Richard Harris, a global SaaS executive, as CEO.

Jun 27, 2022
Notarize Cuts 25% Of Staff, Citing Need To ‘Evolve’

CEO of online notary service says economy, world events create ‘uncertainty’

Jun 22, 2022
New Fights Old

Active push for high-tech mortgages gets pushback from consumers

Jun 21, 2022
Blockchain, Artificial Intelligence & Machine Learning: Hype or Help?

All Three Could Contribute To Faster Digital Transformation

Jun 21, 2022