More than 200 personal finance apps are at risk of a mobile banking Trojan dubbed EventBot, which is designed to steal user data, security researchers warn.

First spotted in the wild by Cybereason, EventBot is focused on Android devices and attempts to take advantage of its accessibility features.

The range of targets EventBot could potentially infect represent some of the best-known financial service mobile apps on the market. The mobile banking Trojan can even infiltrate cryptocurrency wallets such as Coinbase, researchers said.

How EventBot Makes Its Entrance

Like similar cyberthreats, EventBot makes its way onto smartphones through malicious apps designed to resemble legitimate tools, such as Microsoft Word or Adobe Flash. These programs operate as a keylogger upon installation by sending a request to the mobile OS’s accessibility services.

The Trojan runs in the background of the device and begins tracking everything typed into the smartphone once those permissions have been granted. Even notifications and text messages can be read by hackers once the malware has gained a foothold, researchers said.

The investigation suggested EventBot is a serious cybersecurity issue, given its focus on financial service apps and the fact that its approach is based on services that are critical to Android’s functionality.

The data stolen via the Trojan ranges from banking passwords to two-factor authentication (2FA) codes. The information can then be used for a variety of purposes, researchers added. This includes everything from hijacking financial transactions to identity theft and, of course, taking funds from a victim’s account.

EventBot is likely to evolve considerably over time. Already, researchers noted that there have been changes in the way it encrypts communication with a command-and-control (C&C) server. The threat’s authors have also added capabilities, such as a way to steal a victim’s lock code or gain access to settings that could give cybercriminals greater privileges.

Put an End to EventBot Before It Begins

IT security teams managing a fleet of Android devices for a company can defend themselves against the likes of EventBot with a robust security information and event management (SIEM) solution. Teams should also use threat intelligence to keep abreast of major variations and evolutions in the overall threat landscape.

Individual consumers, meanwhile, should always be wary of downloading apps from sources other than the official app stores: Google Play and the Apple App Store.

More from

How Do You Plan to Celebrate National Computer Security Day?

In October 2022, the world marked the 19th Cybersecurity Awareness Month. October might be over, but employers can still talk about awareness of digital threats. We all have another chance before then: National Computer Security Day. The History of National Computer Security Day The origins of National Computer Security Day trace back to 1988 and the Washington, D.C. chapter of the Association for Computing Machinery’s Special Interest Group on Security, Audit and Control. As noted by National Today, those in…

Abuse of Privilege Enabled Long-Term DIB Organization Hack

From November 2021 through January 2022, the Cybersecurity and Infrastructure Security Agency (CISA) responded to an advanced cyberattack on a Defense Industrial Base (DIB) organization’s enterprise network. During that time frame, advanced persistent threat (APT) adversaries used an open-source toolkit called Impacket to breach the environment and further penetrate the organization’s network. Even worse, CISA reported that multiple APT groups may have hacked into the organization’s network. Data breaches such as these are almost always the result of compromised endpoints…

Deploying Security Automation to Your Endpoints

Globally, data is growing at an exponential rate. Due to factors like information explosion and the rising interconnectivity of endpoints, data growth will only become a more pressing issue. This enormous influx of data will invariably affect security teams. Faced with an enormous amount of data to sift through, analysts are feeling the crunch. Subsequently, alert fatigue is already a problem for analysts overwhelmed with security tasks. With the continued shortage of qualified staff, organizations are looking for automation to…

Worms of Wisdom: How WannaCry Shapes Cybersecurity Today

WannaCry wasn't a particularly complex or innovative ransomware attack. What made it unique, however, was its rapid spread. Using the EternalBlue exploit, malware could quickly move from device to device, leveraging a flaw in the Microsoft Windows Server Message Block (SMB) protocol. As a result, when the WannaCry "ransomworm" hit networks in 2017, it expanded to wreak havoc on high-profile systems worldwide. While the discovery of a "kill switch" in the code blunted the spread of the attack and newly…