An Android mobile banking malware named “Godfather” has been targeting and stealing the banking and cryptocurrency exchange credentials of Android users in 16 countries, Bleeping Computer reports.
The malware, which also targeted 400 international financial companies, works by generating fake login screens that appear on top of legitimate banking and crypto exchange apps’ login forms. According to malware analysts Group-IB, any data entered into the login fakes, such as usernames and passwords, are harvested.
Group-IB first detected Godfather in June 2021 and describes it as a successor to an old banking Trojan called Anubis, which became outdated due to Android updates and the “efforts of malware detection and prevention providers.”
In June 2022, the Godfather stopped circulating before a modified and more effective version reappeared in September. As of October, 215 international banks, 94 cryptocurrency wallets, and 110 crypto exchange platforms have been targeted by Godfather. Analysts say that the majority of targeted companies are located in the US (49), Turkey (31), Spain (30), Canada (22), Germany (20), France (19), and the UK (17).
In a blog post, Group-IB alleges that if the language preference of a system targeted by the malware includes a language in post-Soviet Union countries, the Trojan shuts down, which “suggest” that its developers are Russian speakers.
Once installed on a device, Godfather imitates Google Play Protect, a default security tool found on Android devices, and can even emulate a scanning action. This is in a bid to request access to the Accessibility Service, which if approved by the victim, allows the Godfather access to SMS texts and notifications, screen recording, contacts, making calls, writing to external storage, and reading the device status.
It’s at this point, with an Android’s Accessibility Service abused, that the malware can do its dirtiest work: exfiltrating passwords including Google Authenticator codes, and generating fake notifications from installed apps on the victim’s device to take them to a phishing page. The Godfather can also use its screen recording abilities to record usernames and passwords entered into any app, or website by the victim, Bleeping Computer reports.
The malware can also lock and dim the screen, exfiltrate and block notifications, and enable silent mode on a device.
A Google spokesperson told PCMag: “Google Play Protect checks Android devices with Google Play Services for potentially harmful apps from other sources. Users are protected by Google Play Protect, which blocks these identified malicious apps on Android devices.”
