Roaming Mantis Financial Hackers Targeting Android and iPhone Users in France

The mobile threat campaign tracked as Roaming
Mantis has been linked to a new wave of compromises
directed against French mobile phone users, months after it
expanded its targeting to include European countries.

No fewer than 70,000 Android devices are said to have been
infected as part of the active malware operation, Sekoia said in a
report published last week.

Attack chains involving Roaming Mantis^[1], a financially motivated
Chinese threat actor, are known to either deploy a piece of banking
trojan named MoqHao (aka XLoader) or redirect iPhone users to
credential harvesting landing pages that mimic the iCloud login
page.

“MoqHao (aka Wroba, XLoader for Android) is an Android remote
access trojan (RAT) with information-stealing and backdoor
capabilities that likely spreads via SMS,” Sekoia researchers
said^[2].

It all starts with a phishing SMS, a technique known as
smishing, enticing users with package delivery-themed messages
containing rogue links, that, when clicked, proceed to download the
malicious APK file, but only after determining if a victim’s
location is within French borders.

Should a recipient be located outside France and the device
operating system is neither Android nor iOS – a factor ascertained
by checking the IP address and the User-Agent^[3]
string – the server is designed to respond with a “404 Not found^[4]” status code.

“The smishing campaign is therefore geofenced and aims to
install Android malware, or collect Apple iCloud credentials,” the
researchers pointed out.

MoqHao typically uses domains^[5]
generated through the dynamic DNS service Duck DNS for its
first-stage delivery infrastructure. What’s more, the malicious app
masquerades as the Chrome web browser application to trick users
into granting it invasive permissions.

The spyware trojan provides a pathway window for remote
interaction with the infected devices, enabling the adversary to
stealthily harvest sensitive data such as iCloud data, contact
lists, call history, SMS messages, among others.

Sekoia also assessed that the amassed data could be used to
facilitate extortion schemes or even sold to other threat actors
for profit. “more than 90.000 unique IP addresses that requested
the C2 server distributing MoqHao,” the researchers noted.