eScan reveals malware targeting online banking consumers

 eScan has alerted online banking users about the latest HijackRAT and Emotet malware that are posing threat to online banking customers by stealing their sensitive information.

Recently, researchers have discovered a new Android malware named HijackRAT, which is capable of stealing personal information such as banking credentials and login details of the infected users. It also allows hackers to easily get the remote access of the infected device. HijackRAT gets onto user's device through a malicious app called Google Service Framework, which is said to be the most advanced malware application ever discovered.

The Google Service Framework application apparently steals data, sends SMS messages to user's contact list, and initiates malicious app updates. This application searches genuine banking apps installed on the device of the victim and replaces them with malicious ones. According to the researchers, cybercriminals have designed a framework to conduct bank hijacking through this application. Currently, this app is being used to target customers of Korean banks but cybercriminals could quickly and conveniently use it to target other financial institutions too.

As per researchers, the package name of this new RAT malware is “com.ll” and it appears as Google Service Framework with the default Android icon. Researchers say that this is a work in progress app and they are unaware of what the replaced fake banking apps will do.

Apart from Android banking malware, there is a new banking malware named Emotet, which is being floated through spam emails. The hackers try to trick the customers by letting believe that it is a legitimate shipping invoice sent by the bank. These spam emails are basically related to money transfers or shipping invoices. It contains an embedded link, which when clicked installs the Emotet malware onto the user's computer. The Emotet malware also downloads a .DLL file that is responsible for network sniffing activities.