Hackers are taking legitimate banking apps and decompiling them in order to add malicious code, then spreading them through common threat schemes like phishing lures and fake look-a-like websites. According to researchers at Group-IB, these poisoned apps may be linked to the GoldFactory group which is also known for stealing facial recognition data.
This malware campaign has enabled them to not only expose thousands of people to banking fraud, but also to get full control over an infected device. The attackers also add trojans or backdoors to the apps and in total, Group-IB found 27 original banking applications that had been tampered with so far. After injecting malicious code into an app, the hackers behind this campaign will then impersonate a government agency or service through smishing, phishing or social engineering tactics so that potential victims are fooled into visiting a website that mimics an actual government website.
