Over 800 Android Apps Targeted in PIN-Stealing Trojan Campaign

"The malware surge affecting over 800 Android apps is turning a legitimate system feature into a surveillance tool, enabling attackers to exploit at scale."

"By abusing the Android overlay feature, the malware can monitor screen content, user interactions, capture PIN entries, and deploy fake screens."

"Zimperium identified four parallel Android banking campaigns, each with different execution chains, but a shared objective of exploiting user permissions."

"Attackers rely on various forms of phishing to gain a foothold on victims' devices, including impersonating legitimate platforms and sending urgency-driven SMS messages."

A surge in malware affecting over 800 Android apps is utilizing the overlay feature to monitor screen content and capture PIN entries. Four distinct banking trojans, identified as RecruitRat, SaferRat, Astrinox, and Massiv, exploit user permissions through phishing and social engineering tactics. Attackers impersonate legitimate platforms and use urgency-driven SMS messages to lure victims into clicking malicious links. The malware requests permissions under the guise of normal functionality, allowing it to initiate sensitive actions and potentially take over devices or accounts.

Read at TechRepublic