SharkBot Banking Malware Spreading via Fake Android Antivirus App on Google Play Store

The threat actor behind a nascent Android banking trojan named
SharkBot^[1]
has managed to evade Google Play Store security barriers by
masquerading as an antivirus app.

SharkBot, like its malware counterparts TeaBot^[2], FluBot^[3], and Oscorp^[4]
(UBEL), belongs to a category of financial trojans capable of
siphoning credentials to initiate money transfers from compromised
devices by circumventing multi-factor authentication mechanisms. It
first emerged on the scene in November 2021.

Where SharkBot stands apart is in its ability to carry out the
unauthorized transactions via Automatic Transfer Systems (ATS),
which stands in contrast to TeaBot, which requires a live operator
to interact with the infected devices to conduct the malicious
activities.

“The ATS features allow the malware to receive a list of events
to be simulated, and they will be simulated in order to do the
money transfers,” Alberto Segura and Rolf Govers, malware analysts
at cybersecurity firm NCC Group, said^[5]
in a report published last week.

“Since these features can be used to simulate touches/clicks and
button presses, it can be used to not only automatically transfer
money but also install other malicious applications or
components.”

In other words, ATS is employed to deceive the targeted bank’s
fraud detection systems by simulating the same sequence of actions
that would be performed by the user, such as button presses,
clicks, and gestures, in order to make the illicit money
transfer.

The latest version spotted on the Google Play Store on February
28 are a number of dropper apps that also leverages Android’s
Direct Reply functionality to propagate itself to other devices,
making it the second banking trojan after FluBot^[6]
to intercept notifications for wormable attacks.

The list of malicious apps, all of which were updated on
February 10, have been collectively installed about 57,000 times to
date –

SharkBot is also feature-rich in that it enables the adversary
to inject fraudulent overlays atop official banking apps to steal
credentials, log keystrokes, and obtain full remote control over
the devices, but only after the victims grant it Accessibility
Services permissions.

The findings come a week after researchers from Cleafy disclosed^[7]
details of a new TeaBot variant found in the Play Store that’s
designed to target users of more than 400 banking and financial
apps, including those from Russia, China, and the U.S.