Search

Google Removes Malware Infected Two-Factor Authentication App Stealing Banking Details From Play Store

The app was removed after it accumulated over 10,000 downloads on the Play Store.

Advertisement
Highlights
  • The 2FA Authenticator app was infected with the Vultr malware
  • It is capable of recording the screen when a banking app is used
  • The malware mimicked an open-source two-factor authentication app
Google Removes Malware Infected Two-Factor Authentication App Stealing Banking Details From Play Store

Users who installed the infected app will have to manually remove it from their devices

Photo Credit: Pixabay/ andrekheren

Two-factor authentication is widely considered one of the best ways of securing accounts online, but a fraudulent application posing as one was recently caught stealing financial information of users on Android smartphones. A security firm discovered that the app was posing as an open-source application that offers the same functionality. The two-factor authentication app, which was infected with a nefarious banking trojan, was downloaded over 10,000 times before it was removed by Google in the latest example of malicious developers finding new ways to steal user information.

The ‘2FA Authenticator' app was recently identified as malware by researchers from security firm Pradeo and contains the dangerous Vultur Android malware. Attackers that infect Android devices with the Vultur malware can use remote access software to mirror a user's screen and steal login credentials. The malware was first discovered last year and is able to record a smartphone's screen while finance-related apps are being used.

2fa malware pradeo security vultr malware

The listing for the app on the Google Play store, which is currently unavailable
Photo Credit: Screenshot/ Google Play

According to the researchers, the 2FA Authenticator app is designed to mimic the interface of the open-source Aegis Authenticator application, in order to maintain a low profile. It attacks users devices in two stages. The application's malicious code allows it to collect and transmit a list of the applications installed on a users phone and their location, and then use attacks at applications used in those regions. It is also capable of disabling the phone's PIN or password and downloading third-party apps under the guise of providing updates.

After identifying the user's region, the malware installs the Vultur malware, which can use remote screen access to steal user credentials from a user's smartphone when banking and cryptocurrency applications are opened. The malware can also perform activities when the app is closed and takes advantage of a critical permission called SYSTEM_ALERT_WINDOW to overlay applications on the smartphone. The application spent 15 days on the Google Play store where it racked up over 10,000 downloads, before it was removed by Google. However, users who have the app installed on their device should remove the app immediately, according to the researchers.


Why is 5G taking so long? We discuss this on Orbital, the Gadgets 360 podcast. Orbital is available on Spotify, Gaana, JioSaavn, Google Podcasts, Apple Podcasts, Amazon Music and wherever you get your podcasts.
Affiliate links may be automatically generated - see our ethics statement for details.

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.

 
Show Full Article
Please wait...
Advertisement

Related Stories

Popular Mobile Brands
  1. Samsung One UI 8 Blocks the Ability to Flash Custom ROMs: Report
  2. OnePlus Buds 4 Review: The New Standard for Value ANC Earbuds
  1. WhatsApp Said to Be Testing Feature That Lets You Import Profile Photos from Facebook or Instagram
  2. Samsung One UI 8 Update Removes OEM Unlocking Option for Flashing Custom ROMs: Report
  3. Oppo Reno 14FS 5G Price, Design and Specifications Leaked Ahead of Anticipated Debut
  4. Samsung Galaxy A07 Listed on Google Play Console With Design, Key Specifications: Report
  5. Microsoft SharePoint Hack: Probe on Whether Chinese Hackers Found Flaw via Alert
  6. Samsung Reportedly in Talks With OpenAI, Perplexity to Offer Gemini AI Alternatives on Galaxy S26 Series
  7. Redmi 15 Design Renders, Specifications Leaked; Tipped to Arrive in Three Colourways
  8. Google Pixel 10 Pro, Pixel 10 Pro XL Spotted in Moonstone Colourway Alongside Pixel Buds 2a and Pixel Watch 4
  9. Meta Names ChatGPT Co-Creator Shengjia Zhao as Chief Scientist of Superintelligence Lab
  10. Who-Fi: An AI-Powered Wi-Fi Technology That Can Identify and Track Individuals Without Cameras
© Copyright Red Pixels Ventures Limited 2025. All rights reserved.
Trending Products »
Latest Tech News »