Google Removes Malware Infected Two-Factor Authentication App Stealing Banking Details From Play Store

The app was removed after it accumulated over 10,000 downloads on the Play Store.

Advertisement
By David Delima | Updated: 1 February 2022 14:59 IST
Highlights
  • The 2FA Authenticator app was infected with the Vultr malware
  • It is capable of recording the screen when a banking app is used
  • The malware mimicked an open-source two-factor authentication app
Google Removes Malware Infected Two-Factor Authentication App Stealing Banking Details From Play Store

Users who installed the infected app will have to manually remove it from their devices

Photo Credit: Pixabay/ andrekheren

Two-factor authentication is widely considered one of the best ways of securing accounts online, but a fraudulent application posing as one was recently caught stealing financial information of users on Android smartphones. A security firm discovered that the app was posing as an open-source application that offers the same functionality. The two-factor authentication app, which was infected with a nefarious banking trojan, was downloaded over 10,000 times before it was removed by Google in the latest example of malicious developers finding new ways to steal user information.

The ‘2FA Authenticator' app was recently identified as malware by researchers from security firm Pradeo and contains the dangerous Vultur Android malware. Attackers that infect Android devices with the Vultur malware can use remote access software to mirror a user's screen and steal login credentials. The malware was first discovered last year and is able to record a smartphone's screen while finance-related apps are being used.

The listing for the app on the Google Play store, which is currently unavailable
Photo Credit: Screenshot/ Google Play

According to the researchers, the 2FA Authenticator app is designed to mimic the interface of the open-source Aegis Authenticator application, in order to maintain a low profile. It attacks users devices in two stages. The application's malicious code allows it to collect and transmit a list of the applications installed on a users phone and their location, and then use attacks at applications used in those regions. It is also capable of disabling the phone's PIN or password and downloading third-party apps under the guise of providing updates.

Advertisement

After identifying the user's region, the malware installs the Vultur malware, which can use remote screen access to steal user credentials from a user's smartphone when banking and cryptocurrency applications are opened. The malware can also perform activities when the app is closed and takes advantage of a critical permission called SYSTEM_ALERT_WINDOW to overlay applications on the smartphone. The application spent 15 days on the Google Play store where it racked up over 10,000 downloads, before it was removed by Google. However, users who have the app installed on their device should remove the app immediately, according to the researchers.


Why is 5G taking so long? We discuss this on Orbital, the Gadgets 360 podcast. Orbital is available on Spotify, Gaana, JioSaavn, Google Podcasts, Apple Podcasts, Amazon Music and wherever you get your podcasts.
Affiliate links may be automatically generated - see our ethics statement for details.
 

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.

Advertisement

Related Stories

Popular Mobile Brands
  1. Apple's M4 Mac Mini Price in India Drops to Rs. 49,999 With These Discounts
  2. Poco F7 Design Spotted in Leaked Renders; Battery Specifications Revealed
  3. Samsung Teases Galaxy M36 Launch; Phone Spied Online Alongside Galaxy F36
  4. Here's When Samsung Might Launch the Galaxy Z Fold 7 and Z Flip 7
  5. OnePlus Pad Lite Design and Specifications Leaked, Could Launch Soon
  1. OnePlus Pad Lite Design and Key Specifications Leaked, Could Launch Soon
  2. Samsung's Upcoming Running Events Reportedly Hint at Galaxy Z Fold 7, Flip 7 and Watch 8 Series Launch Timeline
  3. Poco F7 Design Spotted in Leaked Renders; Battery Specifications Revealed via Flipkart
  4. Neuralink Device Helps Monkey See Something That’s Not There
  5. Apple's Mac Mini With M4 Chip Price in India Drops to Rs. 49,999 With Discounts on Amazon
  6. Samsung Galaxy M36, Galaxy F36 Spotted on Google Play Console; Galaxy M36 Launch Reportedly Teased via Amazon
  7. Google, Scale AI's Largest Customer, Said to Plan Split After Meta Deal
  8. SpaceX Launches 26 New Starlink Satellites, Expands Global Internet Network
  9. Aurora Alert! Northern Lights May Be Visible as Far South as New York on June 14
  10. New Island Forms in Caspian Sea as Water Levels Drop, Russian Scientists Confirm
Gadgets 360 is available in
Download Our Apps
Available in Hindi
© Copyright Red Pixels Ventures Limited 2025. All rights reserved.