Malicious app in the Play Store spotted distributing Xenomorph Banking Trojan

Experts discovered two new malicious dropper apps on the Google Play Store distributing the Xenomorph banking malware.

Zscaler ThreatLabz researchers discovered a couple of malicious dropper apps on the Play Store distributing the Xenomorph banking malware.

Xenomorph was first spotted by ThreatFabric researchers in February 2022, at the time the malware was employed in attacks against 56 European banks to steal sensitive information from the devices of their customers.

Xenomorph shares overlaps with the Alien banking trojan, but it has functionalities radically different from the Alien’s one. 

Researchers speculate that the two malware could have been developed by the same actor, or at least by someone familiar with the codebase of the Alien banking Trojan.

Zscaler discovered a malicious app in the Play Store named “Todo: Day manager” with over 1,000 downloads.

The security firm pointed out that in the last 3 months, it has reported over 50+ malicious apps in the Play Store resulting in 500k+ downloads. The apps were used to spread malware families as Joker, Harly, Coper, and Adfraud.

“Our analysis found that the Xenomorph banking malware is dropped from GitHub as a fake Google Service application upon installation of the app. It starts with asking users to enable access permission.” reads the analysis published by ZScaler. “Once provided, it adds itself as a device admin and prevents users from disabling Device Admin, making it uninstallable from the phone. Xenomorph creates an overlay onto legit banking applications to trick users into entering their credentials.”

Upon opening the app, it connects to a Firebase server to get the banking malware payload URL. The it downloads the malicious Xenomorph banking trojan samples from Github. The banking trojan could receive commands from the command-and-control (C2) servers or by decoding Telegram page content.

Zscaler noticed another app, named “経費キーパー” (Expense Keeper), exhibiting similar behavior. However, this app doesn’t retrieve the Dropper URL for the banking payload. 

The experts shared Indicators of Compromise (IoCs) for this threat, they also notified Google that promptly removed the app from the store and banned its developers.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Xenomorph)

[adrotate banner=”5″]

[adrotate banner=”13″]