QR code scanners stealing data from Russian banking apps

Kommersant newspaper" reported that cybersecurity company ThreadFabric discovered 12 Android apps capable of stealing banking app data bypassing Play Store's security mechanisms. The company noted that the apps only download the malicious component when running in certain regions, including Russia. Among the Russian banks whose application data is tracked by the virus are Sberbank, Tinkoff Bank, Uralsib, Post Bank and OTP Bank. Malicious applications mimic document and QR code scanners.

Researchers have identified three groups of malicious applications based on the malicious code they download. One of them, Anatsa, is targeting Russia along with the USA, Great Britain, Austria and other countries. The applications in this group have been installed 200,000 times, one of them, a QR code scanner from the publisher QrBarCode LDC, has been installed more than 50,000 times. ThreatFactor notes that the apps work exactly as described and have received many positive reviews on their pages.

Once installed, the malicious application determines whether or not to download the virus to the phone. If the conditions match this, the program asks the user to download an "update" and grant permission to install unknown applications. Under the guise of an update, the actual malicious code is downloaded, which then requests permission to grant full access to the phone. Due to the fact that the malicious code is downloaded separately from the application, the virus passes checks when it is published in the Play Store.

QR code scanners stealing data from Russian banking apps

Kommersant newspaper" reported that cybersecurity company ThreadFabric discovered 12 Android apps capable of stealing banking app data bypassing Play Store's security mechanisms. The company noted that the apps only download the malicious component when running in certain regions, including Russia. Among the Russian banks whose application data is tracked by the virus are Sberbank, Tinkoff Bank, Uralsib, Post Bank and OTP Bank. Malicious applications mimic document and QR code scanners.

Researchers have identified three groups of malicious applications based on the malicious code they download. One of them, Anatsa, is targeting Russia along with the USA, Great Britain, Austria and other countries. The applications in this group have been installed 200,000 times, one of them, a QR code scanner from the publisher QrBarCode LDC, has been installed more than 50,000 times. ThreatFactor notes that the apps work exactly as described and have received many positive reviews on their pages.

Once installed, the malicious application determines whether or not to download the virus to the phone. If the conditions match this, the program asks the user to download an "update" and grant permission to install unknown applications. Under the guise of an update, the actual malicious code is downloaded, which then requests permission to grant full access to the phone. Due to the fact that the malicious code is downloaded separately from the application, the virus passes checks when it is published in the Play Store.

QR code scanners stealing data from Russian banking apps

Kommersant newspaper" reported that cybersecurity company ThreadFabric discovered 12 Android apps capable of stealing banking app data bypassing Play Store's security mechanisms. The company noted that the apps only download the malicious component when running in certain regions, including Russia. Among the Russian banks whose application data is tracked by the virus are Sberbank, Tinkoff Bank, Uralsib, Post Bank and OTP Bank. Malicious applications mimic document and QR code scanners.

Researchers have identified three groups of malicious applications based on the malicious code they download. One of them, Anatsa, is targeting Russia along with the USA, Great Britain, Austria and other countries. The applications in this group have been installed 200,000 times, one of them, a QR code scanner from the publisher QrBarCode LDC, has been installed more than 50,000 times. ThreatFactor notes that the apps work exactly as described and have received many positive reviews on their pages.

Once installed, the malicious application determines whether or not to download the virus to the phone. If the conditions match this, the program asks the user to download an "update" and grant permission to install unknown applications. Under the guise of an update, the actual malicious code is downloaded, which then requests permission to grant full access to the phone. Due to the fact that the malicious code is downloaded separately from the application, the virus passes checks when it is published in the Play Store.

QR code scanners stealing data from Russian banking apps

Kommersant Gazeta reported that cybersecurity company ThreadFabric discovered 12 Android apps capable of stealing banking app data bypassing Play Store's security mechanisms. The company noted that the apps only download the malicious component when running in certain regions, including Russia. Among the Russian banks whose application data is tracked by the virus are Sberbank, Tinkoff Bank, Uralsib, Post Bank and OTP Bank. Malicious applications mimic document and QR code scanners.

Researchers have identified three groups of malicious applications based on the malicious code they download. One of them, Anatsa, is targeting Russia along with the USA, Great Britain, Austria and other countries. The applications in this group have been installed 200,000 times, one of them, a QR code scanner from the publisher QrBarCode LDC, has been installed more than 50,000 times. ThreatFactor notes that the apps work exactly as described and have received many positive reviews on their pages.

Once installed, the malicious application determines whether or not to download the virus to the phone. If the conditions match this, the program asks the user to download an "update" and grant permission to install unknown applications. Under the guise of an update, the actual malicious code is downloaded, which then requests permission to grant full access to the phone. Due to the fact that the malicious code is downloaded separately from the application, the virus passes checks when it is published to the Play Store.