BankBot Trojan bypasses again security checks implemented by Google for the Play Store

Once again crooks succeeded in publishing a malware in the official Google Play Store deceiving the anti-malware protections implemented by the tech giant.

A team composed of security experts from several security firms has spotted two new malware campaigns targeting Google Play Store users, once of them is spreading a new version of the infamous BankBot banking Trojan.

The BankBot banking Trojan creates phishing login overlays for several real banking applications (i.e. Citibank, WellsFargo, Chase, and DiBa) in efforts to steal users’ login details, it also uses the same technique to steal credentials for many popular apps, including Facebook, WhatsApp, Instagram, Twitter, Youtube, Snapchat, Viber, WeChat, and Uber.

The android malware is also able to intercept text messages and delete them from the victim’s device, in this way it could bypass 2FA implemented by banks.

Google removed at least four previous versions of this banking trojan from the Play Store from the beginning of the year, but crooks always succeeded in proposing a new variant infecting victims of major banks worldwide.

Experts found a second campaign that spreads the same BankBot trojan alongside with the Mazar and Red Alert malware.

“Another set of malicious apps has made it into the official Android app store. Detected by ESET security systems as Android/TrojanDropper.Agent.BKY, these apps form a new family of multi-stage Android malware, legitimate-looking and with delayed onset of malicious activity.” reads the analysis published by ESET.

“We have discovered eight apps of this malware family on Google Play and notified Google’s security team about the issue. Google has removed all eight apps from its store; users with Google Play Protect enabled are protected via this mechanism.”

Researchers from security firms ESET, AVAST, and SfyLabs shared their knowledge on the threat and wrote a joint report.