Google Removes Malware Infected Two-Factor Authentication App Stealing Banking Details From Play Store

Two-factor authentication is widely considered one of the best ways of securing accounts online, but a fraudulent application posing as one was recently caught stealing financial information of users on Android smartphones. A security firm discovered that the app was posing as an open-source application that offers the same functionality. The two-factor authentication app, which was infected with a nefarious banking trojan, was downloaded over 10,000 times before it was removed by Google in the latest example of malicious developers finding new ways to steal user information.

The ‘2FA Authenticator' app was recently identified as malware by researchers from security firm Pradeo and contains the dangerous Vultur Android malware. Attackers that infect Android devices with the Vultur malware can use remote access software to mirror a user's screen and steal login credentials. The malware was first discovered last year and is able to record a smartphone's screen while finance-related apps are being used.

The listing for the app on the Google Play store, which is currently unavailable
Photo Credit: Screenshot/ Google Play

According to the researchers, the 2FA Authenticator app is designed to mimic the interface of the open-source Aegis Authenticator application, in order to maintain a low profile. It attacks users devices in two stages. The application's malicious code allows it to collect and transmit a list of the applications installed on a users phone and their location, and then use attacks at applications used in those regions. It is also capable of disabling the phone's PIN or password and downloading third-party apps under the guise of providing updates.

After identifying the user's region, the malware installs the Vultur malware, which can use remote screen access to steal user credentials from a user's smartphone when banking and cryptocurrency applications are opened. The malware can also perform activities when the app is closed and takes advantage of a critical permission called SYSTEM_ALERT_WINDOW to overlay applications on the smartphone. The application spent 15 days on the Google Play store where it racked up over 10,000 downloads, before it was removed by Google. However, users who have the app installed on their device should remove the app immediately, according to the researchers.