Xenomorph Android Banking Trojan Returns with a New and More Powerful Variant

Mar 10, 2023Ravie LakshmananMobile Security / Android

A new variant of the Android banking trojan named Xenomorph has
surfaced in the wild, the latest findings from ThreatFabric
reveal.

Named “Xenomorph 3rd generation” by the Hadoken
Security Group, the threat actor behind the operation, the updated
version comes with new features that allow it to perform financial
fraud in a seamless manner.

“This new version of the malware adds many new capabilities to
an already feature-rich Android banker, most notably the
introduction of a very extensive runtime engine powered by
Accessibility services, which is used by actors to implement a
complete ATS framework^[1],” the Dutch security
firm said^[2]
in a report shared with The Hacker News.

Xenomorph first came to light^[3]
a year ago in February 2022, when it was found to target 56
European banks through dropper apps^[4]
published on the Google Play Store.

In contrast, the latest iteration of the banker – which has a
dedicated website advertising its features – is designed to target
more than 400 banking and financial institutions, including several
cryptocurrency wallets.

ThreatFabric said it detected samples distributed via Discord’s
Content Delivery Network (CDN), a technique that has witnessed a surge^[5]
since 2020. Two of the Xenomorph-laced apps are listed below –

• Play Protect (com.great.calm)
• Play Protect (meritoriousness.mollah.presser)

“Xenomorph v3 is deployed by a Zombinder app ‘bound’ to a
legitimate currency converter, which downloads as an ‘update’ an
application posing as Google Protect,” ThreatFabric explained.

Zombinder refers to an APK binding service^[6]
advertised on the dark web since March 2022, wherein the malware is
delivered via trojanized versions of legitimate apps. The offering
has since been shut down.

Targets of the latest campaign go beyond its European focus
(i.e., Spain, Italy, and Portugal) to include Belgian and Canadian
financial entities.

Xenomorph, like banking malware, is known to abuse Accessibility
Services to perform fraud through overlay attacks^[8]. It also packs in
capabilities to automatically complete fraudulent transactions on
infected devices, a technique called Automated Transfer System
(ATS).

With banks moving away from SMS for two-factor authentication
(2FA) to authenticator apps, the Xenomorph trojan incorporates an
ATS module that allows it to launch the app and extract the
authenticator codes.

The Android malware further boasts of cookie-stealing functions,
enabling the threat actors to perform account takeover attacks.

“With these new features, Xenomorph is now able to completely
automate the whole fraud chain, from infection to funds
exfiltration, making it one of the most advanced and dangerous
Android Malware trojans in circulation,” the company said.