4 ms·

Are there really Banking trojans in Android? I thought malocious apps can't access data of other apps because everything is sandboxed

• mdp2021 5y ago
  E.g. through VNC. Which is the case of Vultur, which is the relevant case of this contaminated 2FA app. https://arstechnica.com/gadgets/2021/07/new-bank-fraud-malware-called-vultur-infects-thousands-of-devices/ https://arstechnica.com/gadgets/2021/07/new-bank-fraud-malwa... > Vultur is among the first Android threats to record a device screen whenever one of the targeted apps is opened. Vultur uses a real implementation of the VNC screen-sharing application to mirror the screen of the infected device to an attacker-controlled server > The typical modus operandi for Android-based bank-fraud malware is to superimpose a window on top of the login screen presented by a targeted app. The “overlay,” as such windows are usually called, appears identical to the user interface of the banking app, giving victims the impression they’re entering their credentials into a trusted piece of software. Attackers then harvest the credentials, enter them into the app running on a different device, and withdraw money (Also: some disable sandboxing through rooting - yet do not use the device consistently)