Faketoken evolves and targets taxi booking apps to steal banking info

Kaspersky discovered a news strain of the mobile banking Trojan Faketoken that displays overlays on top of taxi booking apps to steal banking information.

Security experts from Kaspersky have discovered a news strain of the infamous mobile banking trojan Faketoken that implements capabilities to detect and record an infected device’s calls and display overlays on top of taxi booking apps to steal banking information.

“The authors of its newer modifications continue to upgrade the malware, while its geographical spread is growing. Some of these modifications contain overlay mechanisms for about 2,000 financial apps. In one of the newest versions, we also detected a mechanism for attacking apps for booking taxis and paying traffic tickets issued by the Main Directorate for Road Traffic Safety.” states the analysis published by Kaspersky.

Now the new variant of the malware dubbed Faketoken.q was improved again to steal credentials from Uber and other booking apps as well.

Faketoken.q is being distributed using bulk SMS messages to trick users into downloading an image file that actually downloads the malware.

The mobile Trojan is composed of two parts, the first part is an obfuscated dropper (verdict: Trojan-Banker.AndroidOS.Fyec.az), the second one is a file with DAT extensions that contains the malware’s main features.

Once victims have downloaded the Android malware it installs the necessary modules and the main payload, which hides its shortcut icon and starts monitoring user’s activities, including calls to launched apps.

When the calls are made to or received from certain phone numbers, Faketoken.q records the conversations and sends the recordings to the attacker’s server. The malicious code also checks which apps the victim is using and when detects the launch of an app whose interface it can clone, it overlays the app with a fake user interface.

The fake user interface presented by Faketoken.q prompts victims to enter their payment card data, including the bank’s verification code.

Researchers observed that the malware is able to display fake interface for many mobile banking apps and other applications, such as:

• Android Pay
• Google Play Store
• Apps for paying traffic tickets
• Apps for booking flights and hotel rooms
• Apps for booking taxis

The Trojan is able to intercept the incoming SMS messages to obtain the SMS code sent by the bank to authorize transactions, then it forwards the code to C&C server.