SpyNote Strikes Again: Android Spyware Targeting Financial Institutions

Jan 05, 2023Ravie LakshmananMobile Security / Surveillance

Financial institutions are being targeted by a new version of
Android malware called SpyNote at least since
October 2022.

“The reason behind this increase is that the developer of the
spyware, who was previously selling it to other actors, made the
source code public,” ThreatFabric said^[1]
in a report shared with The Hacker News. “This has helped other
actors [in] developing and distributing the spyware, often also
targeting banking institutions.”

Some of the notable institutions that are impersonated by the
malware include Deutsche Bank, HSBC U.K., Kotak Mahindra Bank, and
Nubank.

SpyNote (aka SpyMax) is feature-rich and comes with a plethora
of capabilities that allow it to install arbitrary apps; gather SMS
messages, calls, videos, and audio recordings; track GPS locations;
and even hinder efforts to uninstall the app.

It also follows the modus operandi of other banking^[2]
malware^[3]
by requesting for permissions to accessibility services to extract
two-factor authentication (2FA) codes from Google Authenticator and
record keystrokes to siphon banking credentials.

In addition, SpyNote packs in functionalities to plunder
Facebook and Gmail passwords as well as capture screen content by
leveraging Android’s MediaProjection API^[4].

The Dutch security firm said that the most recent iteration of
SpyNote (called SpyNote.C) is the first variant to strike banking
apps as well as other well-known apps like Facebook and
WhatsApp.

It’s also known to masquerade as the official Google Play Store
service and other generic applications spanning wallpapers,
productivity, and gaming categories. A list of some of the SpyNote
artifacts, which are mainly delivered through smishing attacks^[5], is as follows –

• Bank of America Confirmation (yps.eton.application)
• BurlaNubank (com.appser.verapp)
• Conversations_ (com.appser.verapp )
• Current Activity (com.willme.topactivity)
• Deutsche Bank Mobile (com.reporting.efficiency)
• HSBC UK Mobile Banking (com.employ.mb)
• Kotak Bank (splash.app.main)
• Virtual SimCard (cobi0jbpm.apvy8vjjvpser.verapchvvhbjbjq)

SpyNote.C is estimated to have been purchased by 87 different
customers between August 2021 and October 2022 after it was
advertised by its developer under the name CypherRat through a
Telegram channel.

However, the open source availability of CypherRat in October
2022 led to a dramatic increase in the number of samples detected
in the wild, suggesting that several criminal groups are co-opting
the malware in their own campaigns.

ThreatFabric further noted that the original author has since
started work on a new spyware project codenamed CraxsRat, which is
set to be offered as a paid application with similar features.

“This development is not as common within the Android Spyware
ecosystem, but is extremely dangerous and shows the potential start
of a new trend, which will see a gradual disappearance of the
distinction between spyware and banking malware, due to the power
that the abuse of Accessibility services gives to criminals,” the
company said.