Medusa Android Banking Trojan Spreading Through Flubot’s Attacks Network

Two different Android banking Trojans, FluBot and Medusa, are
relying on the same delivery vehicle as part of a simultaneous
attack campaign, according to new research published by
ThreatFabric.

The ongoing side-by-side infections, facilitated through the
same smishing (SMS phishing) infrastructure, involved the
overlapping usage of “app names, package names, and similar icons,”
the Dutch mobile security firm said.

Medusa, first discovered targeting Turkish financial
organizations in July 2020, has undergone several iterations, chief
among which is the ability to abuse accessibility permissions in
Android to siphon funds from banking apps to an account controlled
by the attacker.

“Medusa sports other dangerous features like keylogging,
accessibility event logging, and audio and video streaming — all
these capabilities provide actors with almost full access to [a] victim’s device,” the researchers said^[1].

The malware-ridden apps used in conjunction with FluBot
masquerade as DHL and Flash Player apps to infect the devices. In
addition, recent attacks involving Medusa have expanded their focus
beyond Turkey to include Canada and the U.S., with the operators
maintaining multiple botnets for each of its campaigns.

FluBot^[2]
(aka Cabassous), for its part, has received a novel upgrade of its
own: the ability to intercept and potentially manipulate
notifications from targeted applications on a victim’s Android
device by leveraging the direct reply action^[3], alongside auto-replying
to messages from apps like WhatsApp to spread phishing links in a
worm-like fashion.

“With this functionality, this malware is able to provide
[command-and-control server] supplied responses to notifications of
targeted applications on the victim’s device,” the researchers
said, adding the functionality “can be used by actors to sign
fraudulent transactions on victim’s behalf.”

This is not the first time Android malware has been found to
propagate by creating auto-replies to messages in WhatsApp. Last
year, ESET^[4]
and Check Point Research^[5]
uncovered rogue apps posing as Huawei Mobile and Netflix that
employed the same modus operandi to perform the wormable
attacks.

“More and more actors follow Cabassous’ success in distribution
tactics, appropriating masquerading techniques, and using the same
distribution service,” the researchers said. “At the same time,
Cabassous keeps evolving, introducing new features and making
another step towards being able to perform on-device fraud.”