And no, its not @acidyo or @derangedvisions from the OCD community, although them guys are weird, right? This is a new trojan is affecting Android users and the Coinbase, blockchain.com and luno wallets. The trojan is based on the Cerburus trojan from some years back. Google play store was almost free of infected apps, mainly because the group behind it pretty much deserted it when Google discoverd a way to track infected apps, but the trojan has seen new life in recent weeks after its been picked up by a new group and its spreading. There are 226 apps that are currently affected. This particular trojan has the ability to intercept 2fa codes and passwords in transit. This is a dangerous trojan. I would strongly advise anyone using an android device to keep your eyes peeled and uninstall any unused or questionable apps from your devices.
[IMAGE: https://images.hive.blog/DQmZ4cJkHLwsiZQxeBEYGjj9amu2fn3xAdTwRYKAEfCvbxY/fantasy-2847724_1280.jpg]
This first came to my attention a couple of weeks ago when @hetty-rowan hit me up on discord to say she had a lot of weird things happening in her coinbase wallet. Her account had been compromised and she had 2fa enabled. The attacker was able to convert some of her coins to BTC but thankfully they were unable to withdraw the funds from her account as she had the email feature also enabled.
FYI: Hetty does not know the answer to your questions!! There are apps listed below, read the list and if you have an affected app, remove it.
Currently, according to ThreatFabric, Alien boasts the following capabilities:
Can overlay content on top of other apps (feature used for phishing login credentials)
Log keyboard input
Provide remote access to a device after installing a TeamViewer instance
Harvest, send, or forward SMS messages
Steal contacts list
Collect device details and app lists
Collect geo-location data
Make USSD requests
Forward calls
Install and start other apps
Start browsers on desired pages
Lock the screen for a ransomware-like feature
Sniff notifications showed on the device
Steal 2FA codes generated by authentication apps
Apps and specific package names for that are infected are listed below.
Package name App name com.coinbase.android Coinbase – Buy & Sell Bitcoin. Crypto Wallet piuk.blockchain.android Blockchain Wallet. Bitcoin, Bitcoin Cash, Ethereum com.bbva.bbvacontigo BBVA Spain com.bankinter.launcher Bankinter Móvil es.bancosantander.apps Santander es.univia.unicajamovil UnicajaMovil es.cm.android Bankia es.evobanco.bancamovil EVO Banco móvil com.kutxabank.android Kutxabank com.rsi ruralvía com.akbank.android.apps.akbank_direkt Akbank com.garanti.cepsubesi Garanti BBVA Mobile com.finansbank.mobile.cepsube QNB Finansbank Mobile Banking com.connectivityapps.hotmail Connect for Hotmail & Outlook: Mail and Calendar com.teb CEPTETEB com.ykb.android Yapı Kredi Mobile finansbank.enpara Enpara.com Cep Şubesi com.tmobtech.halkbank Halkbank Mobil com.kuveytturk.mobil Kuveyt Türk com.ziraat.ziraatmobil Ziraat Mobile com.pozitron.iscep İşCep - Mobile Banking com.vakifbank.mobile VakıfBank Mobil Bankacılık es.ibercaja.ibercajaapp Ibercaja com.abnamro.nl.mobile.payments ABN AMRO Mobiel Bankieren pl.pkobp.iko IKO pl.mbank mBank PL pe.com.interbank.mobilebanking Interbank APP jp.co.rakuten_bank.rakutenbank 楽天銀行 -個人のお客様向けアプリ com.sbi.sbifreedomplus - it.copergmps.rt.pf.android.sp.bmps Banca MPS com.google.android.gm Gmail com.mail.mobile.android.mail mail.com mail it.bnl.apps.banking BNL it.ingdirect.app ING Italia com.yahoo.mobile.client.android.mail Yahoo Mail – Organized Email com.db.mm.norisbank norisbank App com.db.pbc.miabanca La Mia Banca eu.unicreditgroup.hvbapptan HVB Mobile Banking de.commerzbanking.mobil Commerzbank Banking - The app at your side de.fiducia.smartphone.android.banking.vr VR Banking Classic de.postbank.finanzassistent Postbank Finanzassistent com.targo_prod.bad TARGOBANK Mobile Banking de.comdirect.android comdirect mobile App de.dkb.portalapp DKB-Banking com.starfinanz.smob.android.sfinanzstatus Sparkasse Ihre mobile Filiale de.consorsbank Consorsbank com.finanteq.finance.ca CA24 Mobile com.boursorama.android.clients Boursorama Banque com.caisseepargne.android.mobilebanking Banque com.cm_prod.bad Crédit Mutuel com.ingdirectandroid - fr.lcl.android.customerarea Mes Comptes - LCL fr.banquepopulaire.cyberplus Banque Populaire fr.creditagricole.androidapp Ma Banque mobi.societegenerale.mobile.lappli L'Appli Société Générale au.com.nab.mobile NAB Mobile Banking com.cibc.android.mobi CIBC Mobile Banking® com.grppl.android.shell.cmblloydstsb73 - com.grppl.android.shell.halifax Halifax: the banking app that gives you extra org.stgeorge.bank St.George Mobile Banking com.att.mywireless - com.chase.sig.android Chase Mobile com.clairmail.fth Fifth Third Mobile Banking com.csam.icici.bank.imobile iMobile by ICICI Bank com.unicredit Mobile Banking UniCredit it.popso.scrignoapp - com.microsoft.office.outlook Microsoft Outlook: Organize Your Email & Calendar com.infonow.bofa Bank of America Mobile Banking com.konylabs.capitalone Capital One® Mobile com.suntrust.mobilebanking SunTrust Mobile App com.usaa.mobile.android.usaa USAA Mobile com.usbank.mobilebanking U.S. Bank - Inspired by customers com.wf.wellsfargomobile Wells Fargo Mobile com.bmo.mobile BMO Mobile Banking it.nogood.container UBI Banca com.rbc.mobile.android RBC Mobile com.latuabancaperandroid Intesa Sanpaolo Mobile com.ingbanktr.ingmobil ING Mobil com.magiclick.odeabank Odeabank posteitaliane.posteapp.apppostepay Postepay tr.com.sekerbilisim.mbank ŞEKER MOBİL ŞUBE com.commbank.netbank CommBank com.android.vending Google Play es.liberbank.cajasturapp Banca Digital Liberbank www.ingdirect.nativeframe ING España. Banca Móvil com.cajasur.android Cajasur com.tecnocom.cajalaboral Banca Móvil Laboral Kutxa com.db.pbc.mibanco Mi Banco db net.inverline.bancosabadell.officelocator.android Banco Sabadell App. Your mobile bank com.bbva.netcash BBVA Net Cash ES & PT es.bancosantander.empresas Santander Empresas com.paypal.android.p2pmobile PayPal Mobile Cash: Send and Request Money Fast pl.bzwbk.bzwbk24 Santander mobile es.caixageral.caixageralapp Banco Caixa Geral España alior.bankingapp.android Usługi Bankowe eu.eleader.mobilebanking.pekao Pekao24Makler eu.eleader.mobilebanking.pekao.firm PekaoBiznes24 com.facebook.katana Facebook com.imaginbank.app imaginBank - Your mobile bank com.whatsapp WhatsApp Messenger com.snapchat.android Snapchat com.twitter.android Twitter org.telegram.messenger Telegram com.instagram.android Instagram com.viber.voip Viber Messenger - Messages, Group Chats & Calls es.lacaixa.mobile.android.newwapicon CaixaBank softax.pekao.powerpay PeoPay com.ebay.mobile eBay: Buy, sell, and save money on home essentials com.amazon.mshop.android.shopping - com.getingroup.mobilebanking Getin Mobile wit.android.bcpbankingapp.millenniumpl - com.konylabs.cbplpat Citi Handlowy es.caixagalicia.activamovil ABANCA- Banca Móvil com.moneybookers.skrillpayments.neteller NETELLER - fast, secure and global money transfers com.pcfinancial.mobile Simplii Financial com.td TD Canada cz.csob.smartbanking ČSOB Smartbanking com.airbitz Bitcoin Wallet - Airbitz clientapp.swiftcom.org ePayments: wallet & bank card de.number26.android N26 — The Mobile Bank au.com.ingdirect.android ING Australia Banking com.payoneer.android Payoneer – Global Payments Platform for Businesses com.cimbmalaysia CIMB Clicks Malaysia eu.eleader.mobilebanking.invest plusbank24 com.moneybookers.skrillpayments Skrill - Fast, secure online payments com.mycelium.wallet Mycelium Bitcoin Wallet uk.co.santander.santanderuk - com.aff.otpdirekt OTP SmartBank com.kasikorn.retail.mbanking.wap K PLUS com.krungsri.kma KMA com.scb.phone SCB EASY com.netflix.mediaclient Netflix com.bendigobank.mobile Bendigo Bank com.citibank.citibankmy - com.konylabs.hongleongconnect - org.banksa.bank BankSA Mobile Banking org.bom.bank Bank of Melbourne Mobile Banking at.volksbank.volksbankmobile Volksbank hausbanking net.bnpparibas.mescomptes Mes Comptes BNP Paribas com.ocito.cdn.activity.creditdunord Crédit du Nord pour Mobile pl.bph BusinessPro Lite pt.bancobpi.mobile.fiabilizacao BPI APP pt.novobanco.nbapp NB smart app pt.santandertotta.mobileparticulares Santander Particulares com.bankofqueensland.boq BOQ Mobile fr.laposte.lapostemobile La Poste - Services Postaux com.cic_prod.bad CIC com.fortuneo.android Fortuneo, mes comptes banque & bourse en ligne nz.co.asb.asbmobile ASB Mobile Banking pl.bzwbk.ibiznes24 iBiznes24 mobile pl.millennium.corpapp - net.garagecoders.e_llavescotiainfo ScotiaMóvil com.credemmobile - it.carige Carige Mobile eu.inmite.prj.kb.mobilbank Mobilni Banka jp.co.netbk 住信SBIネット銀行 au.com.cua.mb CUA Mobile Banking com.advantage.raiffeisenbank - com.bankaustria.android.olb Bank Austria MobileBanking com.barclays.android.barclaysmobilebanking Barclays com.bochk.com BOCHK com.htsu.hsbcpersonalbanking HSBC Mobile Banking com.anz.android.gomoney ANZ Australia com.bankia.wallet Bankia Wallet com.fusion.banking Bank Australia app com.fusion.beyondbank Beyond Bank Australia com.greater.greater - com.bancsabadell.wallet Sabadell Wallet es.bancosantander.wallet Santander Wallet com.fullsix.android.labanquepostale.accountaccess La Banque Postale com.cajamar.cajamar - wit.android.bcpbankingapp.millennium - enterprise.com.anz.shield ANZ Shield com.fibabanka.mobile Fibabanka Corporate Mobile com.mobileloft.alpha.droid myAlpha Mobile mbanking.nbg - com.eurobankefg - es.bancopopular.nbmpopular Popular ktbcs.netbank Krungthai NEXT com.bbva.bbvawallet BBVA Wallet Spain. Mobile Payment com.bancomer.mbanking BBVA México (Bancomer Móvil) ar.com.santander.rio.mbanking Santander Argentina com.mercadolibre Mercado Libre: compra fácil y rápido es.santander.money Santander Money Plan com.dhanlaxmi.dhansmart.mtc Dhanlaxmi Bank Mobile Banking com.infrasofttech.centralbank - com.infrasofttech.mahabank - com.msf.kbank.mobile Kotak - 811 & Mobile Banking com.sbi.sbanywherecorporate - com.snapwork.hdfc HDFC Bank MobileBanking com.samba.mb SambaMobile eu.netinfo.colpatria.system Scotiabank Colpatria com.todo1.mobile Bancolombia App Personas org.westpac.bank Westpac Mobile Banking au.com.suncorp.suncorpbank - au.com.pnbank.android P&N BANKING APP com.ing.mobile ING Bankieren com.tfkb Türkiye Finans Mobile Branch finansbank.enpara.sirketim Enpara.com Şirketim Cep Şubesi com.google.android.play.games Google Play Games com.icomvision.bsc.tbc TBC Bank com.citi.citimobile Citi Mobile® com.tdbank TD Bank (US) com.unionbank.ecommerce.mobile.android Union Bank Mobile Banking com.comarch.security.mobilebanking ING Business de.sdvrz.ihb.mobile.secureapp.sparda.produktion SpardaSecureApp au.com.bankwest.mobile Bankwest com.hsbc.hsbcnet HSBCnet Mobile com.nearform. ptsb permanent tsb org.banking.bom.businessconnect Bank of Melbourne Business App org.banking.bsa.businessconnect BankSA Business App org.banking.stg.businessconnect St.George Business App org.westpac.col Westpac Corporate Mobile ca.bnc.android National Bank of Canada ca.servus.mbanking Servus Mobile Banking co.bitx.android.wallet Luno: Buy Bitcoin, Ethereum and Cryptocurrency com.acceltree.mtc.screens Alawwal Mobile enbd.mobilebanking Emirates NBD lt.spectrofinance.spectrocoin.android.wallet Bitcoin Wallet by SpectroCoin com.skype.raider Skype - free IM & video calls com.barclaycardus Barclays US com.grppl.android.shell.bos - com.rbs.mobile.android.natwest NatWest Mobile Banking com.rbs.mobile.android.rbs Royal Bank of Scotland Mobile Banking tsb.mobilebanking TSB Bank Mobile Banking net.inverline.bancosabadell.officelocator.activobank ActivoBankAs you can see there is a massive number of affected apps so be super careful with what you are doing and I would strongly advise everyone reading this to audit your apps and if you don't need it, bin it!