Alien Malware Infects More than 226 Mobile Apps and Steals Bank Data

As reported on September 24, 2020, by ZDNet and ThreatPost, a new strain of malware named “Alien” is running rampant on the Android platform that has the power to steal passwords from more than 226 mobile apps!

The Dirty Details of Alien

Alien’s lineage comes from the infamous Cerberus banking trojan targeting victims’ banking data and personal information for identity theft. Most notably, a few of the apps on the list are Bank of America Mobile Banking and Capital One Mobile, along with social media and collaboration apps like Telegram, Snapchat, and Microsoft Outlook. 

As Cerberus slowly dies out, hackers are turning to Alien to fill the void. Rumor has it that Google discovered a way to detect and clean infected devices, which led to the demise of Cerberus. Alien is based on Cerberus code but enhanced with some extra features making it very dangerous. 

As early as January of this year, Alien was offered on the dark web as a Malware-as-a-Service (MaaS) and has been used by hackers worldwide to target banking institutions in various countries, including France, Germany, Italy, and the United States. 

According to cybersecurity experts, this variant of Cerberus has the ability to harvest and control SMS messages, access contact lists, keylogging functions, collect location data (GPS), forward calls, open web browsers, and employ overlay attacks (meaning phish login credentials by overlaying real login screens with fake ones). 

Most alarmingly, Alien is sophisticated enough to sniff notifications of infected apps, thwart two-factor authentication (2FA), and steal passwords. Alien does this by exploiting the “android.permission.BIND_NOTIFICATION_LISTENER_SERVICE” to control the user’s device’s notifications. In conjunction with this vulnerability, Alien uses the collaboration app TeamViewer to take complete control of the mobile device to change settings, install or uninstall apps, open apps, view information, and use the phone as if it was their own. Using TeamViewer, cybercriminals can also lock the screen like ransomware and demand money to unlock it. Alien is a mobile device user’s nightmare. 

Why You Should Be Concerned 

Alien is extremely dangerous because it targets user data, financial accounts, and other functions designed to allow fraudsters to steal money. Along with targeting banking apps, the malware also intercepts email and allows complete access to social media, instant messaging, and cryptocurrency apps like WhatsApp, Snapchat, Twitter, Telegram, Facebook, and Gmail. 

How You Can Avoid an Alien Infection

Although it’s not clear how mobile devices are infected with Alien, the evidence traces back to phishing emails, websites, and fake social ads. Some users have been infected through SMS when a friend or family member’s contact list has been stolen and used to phish more victims. Unfortunately, this most recent threat is aimed at non-technical phone users and those who don’t know what dangers to avoid. 

Google’s Play Store is diligent about cleaning and disinfecting apps before they are made available. However, that doesn’t mean that a few malicious apps don’t make it in. Some common-sense tips to avoid being affected by this potentially devastating strain of malware and opening yourself up to identity theft or worse, are:

• Don’t install apps from anywhere except the Google Play Store. 
• If an app asks for permission to an admin user or Accessibility service, deny it.
• Don’t install any software on your phone that you do not trust and don’t just click through the prompts.
• Update your phone’s security patches whenever they are available.
• Install and run anti-malware software frequently.
• Never click links in an email.
• Do not click a link or respond to strange SMS messages even if they look like they come from someone you know.
• Stay away from suspicious websites.
• Never provide login credentials or other personal information online to anyone you don’t know. 
• Do not respond to unsolicited emails, texts, or ads about COVID-related products or apps.

Security threats keep coming, and you have to be diligent and proactive every day to stay safe.