More than 200 personal finance apps are at risk of a mobile banking Trojan dubbed EventBot, which is designed to steal user data, security researchers warn.
First spotted in the wild by Cybereason, EventBot is focused on Android devices and attempts to take advantage of its accessibility features.
The range of targets EventBot could potentially infect represent some of the best-known financial service mobile apps on the market. The mobile banking Trojan can even infiltrate cryptocurrency wallets such as Coinbase, researchers said.
How EventBot Makes Its Entrance
Like similar cyberthreats, EventBot makes its way onto smartphones through malicious apps designed to resemble legitimate tools, such as Microsoft Word or Adobe Flash. These programs operate as a keylogger upon installation by sending a request to the mobile OS’s accessibility services.
The Trojan runs in the background of the device and begins tracking everything typed into the smartphone once those permissions have been granted. Even notifications and text messages can be read by hackers once the malware has gained a foothold, researchers said.
The investigation suggested EventBot is a serious cybersecurity issue, given its focus on financial service apps and the fact that its approach is based on services that are critical to Android’s functionality.
The data stolen via the Trojan ranges from banking passwords to two-factor authentication (2FA) codes. The information can then be used for a variety of purposes, researchers added. This includes everything from hijacking financial transactions to identity theft and, of course, taking funds from a victim’s account.
EventBot is likely to evolve considerably over time. Already, researchers noted that there have been changes in the way it encrypts communication with a command-and-control (C&C) server. The threat’s authors have also added capabilities, such as a way to steal a victim’s lock code or gain access to settings that could give cybercriminals greater privileges.
Put an End to EventBot Before It Begins
IT security teams managing a fleet of Android devices for a company can defend themselves against the likes of EventBot with a robust security information and event management (SIEM) solution. Teams should also use threat intelligence to keep abreast of major variations and evolutions in the overall threat landscape.
Individual consumers, meanwhile, should always be wary of downloading apps from sources other than the official app stores: Google Play and the Apple App Store.