Xenomorph Android Banking Trojan Returns with a New and More Powerful Variant

[MuzzMelbourne]

Content source

https://thehackernews.com/2023/03/xenomorph-android-banking-trojan.html

A new variant of the Android banking trojan named Xenomorph has surfaced in the wild, the latest findings from ThreatFabric reveal.

Named "Xenomorph 3rd generation" by the Hadoken Security Group, the threat actor behind the operation, the updated version comes with new features that allow it to perform financial fraud in a seamless manner.

"This new version of the malware adds many new capabilities to an already feature-rich Android banker, most notably the introduction of a very extensive runtime engine powered by Accessibility services, which is used by actors to implement a complete ATS framework," the Dutch security firm said in a report shared with The Hacker News.

Xenomorph first came to light a year ago in February 2022, when it was found to target 56 European banks through dropper apps published on the Google Play Store.

Xenomorph Android Banking Trojan Returns with a New and More Powerful Variant

A new variant of the Android banking trojan Xenomorph has surfaced in the wild, with new features allowing it to perform financial fraud.

thehackernews.com

 

[HarborFront]

Just don't perform financial transactions using the android phone.

If you really need to use a phone, then use a dedicated phone for financial transactions. Do NOT install other apps except your banking app.

 

[upnorth]

the samples identified by ThreatFabric featured configurations with Target lists made of more than 400 banking and financial institutions, including several cryptocurrency wallets, with an increase of more than 6 times with comparison to its previous variants, including financial institutions from all continents.

In addition, after discovering some samples belonging to this new variant, our researchers also discovered the website dedicated to the advertisement of this Android banker, indicating clear intentions of entering the MaaS landscape, and start large scale distribution.

Xenomorph v3: a new variant with ATS targeting more than 400 institutions — ThreatFabric

A new variant of Xenomorph appears on the horizon: Hadoken Security group advertises the latest version of their product, complete with ATS modules and Cookie session stealer.

www.threatfabric.com