PETALING JAYA: ESET researchers have analysed three malicious Android applications targeting to make a profit off customers who have increasingly turned to online shopping by tricking eager shoppers into downloading malicious applications.
According to an ESET researcher who analysed the malicious applications, Lukáš Štefanko, people are increasingly using smartphones and in the first quarter of 2021, smartphones accounted for 69 per cent of all retail website visits worldwide, and smartphone purchases made up 57 per cent of online shopping orders, which motivates cybercriminals to seek the opportunity to make a profit off this behaviour.
"To make the already couch-friendly approach of online shopping even more convenient, people are increasingly using their smartphones to shop. Smartphone purchases make up the majority of online shopping orders – most of them from vendor-specific applications," he said.
In an ongoing campaign, the threat actors use fake websites that pose as legitimate services, sometimes outright copying the original to steal banking credentials.
"These websites use similar domain names to the services they are impersonating."
This campaign was first reported at the end of 2021, with the attackers impersonating the legitimate cleaning service Maid4u. Distributed through Facebook ads, the campaign tempted potential victims to download Android malware from a malicious website.
In January 2022, MalwareHunterTeam identified three more malicious websites and Android trojans attributed to this campaign. Recently, ESET researchers found four additional fake websites making a total of seven websites impersonated services that are only available in Malaysia.
The copycat websites do not provide an option to shop directly through them. Instead, they include buttons that claim to download apps from Google Play. However, clicking these buttons does not actually lead to the Google Play store, but to servers under the threat actors' control.
To succeed, this attack requires the intended victims to enable the non-default "Install unknown apps" option on their devices. When the time comes to pay for the order, the victims are presented with payment options–they can pay either by credit card or by transferring the required amount from their bank accounts.
At the time this research was active, it was not possible to select the credit card payment option.
After picking the direct transfer option, victims are presented with a fake FPX payment page and asked to choose their bank out of the eight Malaysian banks provided, and then enter their credentials. The targeted banks are Maybank, Affin Bank, Public Bank Berhad, CIMB bank, BSN, RHB, Bank Islam Malaysia, and Hong Leong Bank.
After victims submit their banking credentials, they receive an error message informing them that the user ID or password they provided was invalid. At this point, the entered credentials have been sent to the malware operators.
To make sure the threat actors can get into their victims' bank accounts, the fake e-store applications also forward all SMS messages received by the victim to the operators in case they contain Two-Factor Authentication (2FA) codes sent by the bank.
"While the campaign targets Malaysia exclusively for now, it might expand to other countries and banks later on. At this time, the attackers are after banking credentials, but they may also enable the theft of credit card information in the future," added Štefanko.
ESET Research has found the same malicious code in all three analysed applications, leading us to conclude that they can all be attributed to the same threat actor.
To protect yourself against this type of threat, first, try to ensure that you are using legitimate websites to shop by:
• Verify if the website is secure, i.e., its URL begins with https://. Some browsers might even refuse to open non-HTTPS websites and explicitly warn users or provide an option to enable HTTPS-only mode.
• Be wary of clicking on ads and paid search engine results.
• Pay attention to the source of applications you are downloading. Make sure that you are actually redirected to the Google Play store.
• Use software or hardware 2FA instead of SMS when possible and use mobile security solutions.