NEW DELHI: Cyber security researchers said Thursday they had discovered a new phishing campaign targeting bank customers in India via SMS forwarding apps. According to AI cybersecurity firm CloudSEK, the phishing site collects victims’ banking details and personal information after Android SMS forwarding malware is downloaded onto their devices. The research team discovered multiple domains with the same practices and templates.
“Banks should also take responsibility for raising awareness of such scams and educating their customers to prevent loss of money and reputation,” said Anshuman Das, cyber threat researcher at CloudSEK. As part of the hackers’ operation, victims first enter sensitive banking information such as card number, CVV number, and expiration date on the fake complaints portal. (Also read: Mumbai: Cyber Scammer Skims Rs 3.77 lakh From Woman’s Bank To Sell Furniture)
After banking details are exploited, a malicious customer support application is downloaded onto victim’s devices. “No logos or names of the Indian banks were used on these phishing websites to avoid suspicion and detection. Furthermore, the rogue customer support application is not hosted on Google Play Store or any of the third party application stores. ’ said the researchers.
The malicious application is then used to send all incoming SMS to the scammer’s C2 (Command and Control) server. “Even if a user’s accounts are secured by multi-factor authentication, attackers can still use the app to collect private information, conduct illegal activities on users’ bank accounts, and access their other accounts,” the researchers warn.
CloudSEK researchers discovered and investigated an Android app pretending to be a bank’s customer service app. This application prompts the user for two permissions on their device to receive SMS and send SMS. (Also read: Android Users Warning! New Malware Subscribes Unknowing Users to Premium Services)
The source code of the application is apparently available on Github. The application has no obfuscation or evasion mechanisms that make it difficult for antivirus or other solutions to detect it. After the app is installed on a victim’s cellphone, any SMS received on the device is forwarded with an OTP to the target phone controlled by the attacker, the report said. “It’s important to be extra careful when installing new applications. Only download apps from reputable app stores like Google Play Store and App Store. After installing an application, be careful when granting permissions”, said that.
