New Android Malware Poses as SBI Card and Axis Bank Apps to Steal Financial Data

McAfee’s Mobile Research Team has uncovered a sophisticated malware campaign targeting Android users, particularly those who speak Hindi in India. This operation cleverly disguises itself as legitimate financial applications from well-known institutions such as SBI Card, Axis Bank, and IndusInd Bank.

The malware is distributed via dynamically generated phishing websites that closely resemble official banking portals. By utilizing authentic assets, including images and JavaScript from legitimate sites, these phishing sites enhance their credibility and lure unsuspecting users.

Dual-Threat Campaign

What distinguishes this malware is its dual functionality. It not only exfiltrates sensitive personal and financial data but also covertly mines Monero cryptocurrency using the open-source XMRig tool, which can be activated remotely via Firebase Cloud Messaging (FCM). The malware masquerades as a Google Play update, preying on user trust and prompting installations that ultimately lead to data theft.

As a proactive member of the App Defense Alliance, McAfee promptly reported these threats to Google, leading to the blocking of the associated FCM account to prevent further distribution of the malware. All variants of this malware have been classified as high-risk by McAfee Mobile Security, with telemetry indicating that infections are primarily concentrated in India, although isolated incidents have been reported in other regions.

Cryptomining Payload

The malware employs a multi-stage dropper architecture designed to evade static analysis and detection. Upon installation, the APK presents a counterfeit Google Play interface that prompts users for an “update.” Internally, it decrypts an encrypted DEX file from its assets folder using an XOR key. This first-stage loader then decrypts and dynamically loads a second-stage payload, which appears as a fake financial app interface.

Users are encouraged to input sensitive information such as names, card numbers, CVVs, and expiration dates, which are subsequently transmitted to a command-and-control (C2) server.

After users submit their details, the app displays a misleading confirmation page, simulating legitimacy with messages about email verifications within 48 hours, despite all functionalities being non-operational. Embedded within the second-stage code is a Firebase messaging service declared in the manifest, which listens for remote commands that activate the mining component.

This process involves downloading an encrypted .so binary from one of three hardcoded URLs, which is executed via Java’s ProcessBuilder as a standalone process, mirroring XMRig’s command-line options, including specifications for Monero mining pools. The RandomX algorithm, optimized for CPU efficiency, allows for profitable mining on mobile devices, while Monero’s privacy features obscure transactions, aiding cybercriminals in laundering their illicit gains.

Logs from the decrypted binary confirm the involvement of XMRig, enabling silent background operations without user awareness. This campaign builds upon previous threats targeting India, as highlighted in McAfee’s earlier reports, but innovates by integrating real-time phishing with dynamic payload loading and remote activation.

The staged decryption of the dropper complicates reverse engineering efforts, while FCM-based triggers keep the malware dormant until activated, significantly reducing the risk of detection. Phishing sites often feature “Get App” buttons that deliver the malicious APK, frequently promoted through SMS, WhatsApp, or social media channels.

To mitigate risks, users are advised to download apps exclusively from Google Play, scrutinize unsolicited links, and utilize robust mobile security solutions to defend against such threats. This combination of data theft and cryptojacking highlights the evolving sophistication of malware, necessitating vigilant user practices and advanced security measures.

Indicators of Compromise (IOCs)

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates!