Emulated mobile devices used to steal millions from US, EU banks

silversurfer

Level 75
Verified
Trusted
Content Creator
Malware Hunter
Aug 17, 2014
6,457
Threat actors behind an ongoing worldwide mobile banking fraud campaign were able to steal millions from multiple US and EU banks, needing just a few days for each attack.
To do that, the attackers used huge emulator farms that helped them access thousands of hacked accounts (compromised after phishing or malware attacks) using spoofed mobile devices.
While emulators are not malicious tools, the group behind this campaign used them for malicious purposes emulating compromised devices or setting up what looked like new devices picked up by the compromised accounts' owners.
For setting up the emulated devices, the attackers used a dedicated tool capable of feeding device specs from a database of previously compromised devices, matching each of the spoofed devices with the account holder's banking credentials.
The mobile emulator farm was even able to spoof a compromised device's GPS location using virtual private network (VPN) services to hide the malicious activity from the bank.
1608144621102.png

Data slices from emulator used to spoof over 8,000 devices (IBM Trusteer)
Read more below:

Full report below by researchers:
 
Top