Fans of third-party YouTube apps should watch out for Nexus banking malware
A new Android banking trojan called Nexus has been discovered by Cyble Research and Intelligence Labs (CRIL) and cybersecurity firm Cleafy (via Tom's Guide).
It first appeared in June last year and is now being openly advertised by its creators on hacker forums to increase its reach. Nexus' primary targets are 450 banking and cryptocurrency apps.
It's being distributed through phishing websites posing as legitimate websites of YouTube Vanced, a discontinued third-party YouTube app. It uses all the tricks in the books to gain your banking info and take over your financial accounts.
Nexus asks for 50 permissions and abuses at least 14 of them
It is capable of performing overlay attacks, i.e. replicating a legitimate interface to trick you into entering your credentials, and uses keylogging to record your keystrokes. It can even steal SMS messages to get access to two-factor authentication codes and can abuse Accessibility Services to steal information from crypto wallets, 2-Step Verification codes generated by Google Authenticator, and website cookies. The trojan can also delete messages received by you.
After it's installed on a device, Nexus connects to its command-and-control (C2) server. C2s are used by cybercriminals to control malware, launch attacks, and receive stolen data.
Nexus is said to be in the beta stage but it's already being used by many threat actors to carry out nefarious activities. Cybercriminals who do not know how to make their own malware can rent it for $3,000 a month.
It looks like the developer is from a CIS (Commonwealth of Independent States) country and has prohibited the trojan's use in Azerbaijan, Armenia, Belarus, Kazakhstan, Kyrgyzstan, Moldova, Russian Federation, Tajikistan, Uzbekistan, Ukraine, and Indonesia.
Nexus is capable of updating itself and Cleafy thinks it is a real threat and can infect hundreds of Android devices in the world.
To protect yourself from infections, try to only download apps from Google Play and enable Google Play Protect. Use strong passwords and enable biometric security features where possible and be very careful when granting permissions.
FCC OKs Cingular\'s purchase of AT&T Wireless
Things that are NOT allowed: