More than 200 personal finance apps are at risk of a mobile banking Trojan dubbed EventBot, which is designed to steal user data, security researchers warn.

First spotted in the wild by Cybereason, EventBot is focused on Android devices and attempts to take advantage of its accessibility features.

The range of targets EventBot could potentially infect represent some of the best-known financial service mobile apps on the market. The mobile banking Trojan can even infiltrate cryptocurrency wallets such as Coinbase, researchers said.

How EventBot Makes Its Entrance

Like similar cyberthreats, EventBot makes its way onto smartphones through malicious apps designed to resemble legitimate tools, such as Microsoft Word or Adobe Flash. These programs operate as a keylogger upon installation by sending a request to the mobile OS’s accessibility services.

The Trojan runs in the background of the device and begins tracking everything typed into the smartphone once those permissions have been granted. Even notifications and text messages can be read by hackers once the malware has gained a foothold, researchers said.

The investigation suggested EventBot is a serious cybersecurity issue, given its focus on financial service apps and the fact that its approach is based on services that are critical to Android’s functionality.

The data stolen via the Trojan ranges from banking passwords to two-factor authentication (2FA) codes. The information can then be used for a variety of purposes, researchers added. This includes everything from hijacking financial transactions to identity theft and, of course, taking funds from a victim’s account.

EventBot is likely to evolve considerably over time. Already, researchers noted that there have been changes in the way it encrypts communication with a command-and-control (C&C) server. The threat’s authors have also added capabilities, such as a way to steal a victim’s lock code or gain access to settings that could give cybercriminals greater privileges.

Put an End to EventBot Before It Begins

IT security teams managing a fleet of Android devices for a company can defend themselves against the likes of EventBot with a robust security information and event management (SIEM) solution. Teams should also use threat intelligence to keep abreast of major variations and evolutions in the overall threat landscape.

Individual consumers, meanwhile, should always be wary of downloading apps from sources other than the official app stores: Google Play and the Apple App Store.

More from

Beyond Requirements: Tapping the Business Potential of Data Governance and Security

3 min read - Doom and gloom. Fear, uncertainty and doubt. The "stick" versus the "carrot". What do these concepts have in common? They have often provided the primary motivation for organizations’ data governance and security strategies. For the enterprise, this mindset has perpetuated the idea that data governance, data security and data privacy are reactive cost centers existing due to externally imposed requirements or mandates.Yet, what if data governance and security practices could upend the prevailing paradigm and demonstrate direct business value?[button link="https://community.ibm.com/community/user/security/events/event-description?CalendarEventKey=8d7fdc61-97bf-43b0-b7d6-018756e436a6&CommunityKey=aa1a6549-4b51-421a-9c67-6dd41e65ef85&Home=%2fcommunity%2fuser%2fsecurity%2fcommunities%2fcommunity-home%2frecent-community-events"…

3 min read

Protecting Against Remote Monitoring and Management Phishing

3 min read - You use remote monitoring and management (RMM) software to closely monitor your cyber environment and keep your organization safe. But now cyber criminals are specifically targeting these tools, causing legitimate software to become a vulnerability. This is the latest type of attack in an increase in a recent trend of disruptive software supply chain attacks. The Cybersecurity and Infrastructure Security Agency (CISA) recently released an alert about the malicious use of legitimate remote monitoring and management (RMM) software. Last fall,…

3 min read

Secure-by-Design: Which Comes First, Code or Security?

4 min read - For years, developers and IT security teams have been at loggerheads. While developers feel security slows progress, security teams assert that developers sacrifice security priorities in their quest to accelerate production. This disconnect results in flawed software that is vulnerable to attack. While advocates for speed and security clash, consumers must often pay the price when threat actors strike. 48% of developers admitted they were still shipping code with vulnerabilities in 2022. It’s clearly time for a change. Many believe…

4 min read

ITG10 Likely Targeting South Korean Entities of Interest to the Democratic People’s Republic of Korea (DPRK)

7 min read - In late April 2023, IBM Security X-Force uncovered documents that are most likely part of a phishing campaign mimicking credible senders, orchestrated by a group X-Force refers to as ITG10, and aimed at delivering RokRAT malware, similar to what has been observed by others. ITG10's tactics, techniques and procedures (TTPs) overlap with APT37 and ScarCruft. The initial delivery method is conducted via a LNK file, which drops two Windows shortcut files containing obfuscated PowerShell scripts in charge of downloading a…

7 min read