A new banking Trojan that harvests personal credentials, steals contact details and uses a range of techniques to act as a significant threat to Android users has been discovered.

The Trojan, known as Red Alert 2.0, was revealed by SfyLabs. In a blog post outlining the threat, researchers at the security specialist suggested that the malware has been distributed during the past few months through third-party app stores. The Trojan, which uses new code, relies on surreptitious techniques to steal user credentials and contacts.

SfyLabs detailed the risk of the new threat and outlined some of the original techniques used by its creators to keep it relevant. IT managers and users should note the growing issue of banking malware and must avoid downloading software from nonofficial sources.

How Does the Trojan Work?

The new malware, which can be rented by threat actors, includes many features that are similar to other Android-based banking Trojans. Once downloaded via an infected app, the Trojan sits in the background until a user runs a financial or social media application. SfyLabs research suggested that more than 60 apps have been targeted.

Once one of these targeted apps is opened, Red Alert 2.0 springs to life and presents an HTML-based overlay on the screen. This overlay tells the user there is a problem and asks the individual to re-enter credentials. The Trojan takes this information and sends it to the command-and-control (C&C) server.

Individuals in command of Red Alert are using these illegally collected credentials to make transactions via bank accounts and to push spam via social media networks. Red Alert 2.0 also allows the malicious actors to gather data from contact lists on infected devices.

What Makes This Malware Different?

SfyLabs originally witnessed ads for the Trojan on a Russian breaching forum earlier this year, reported Bleeping Computer. The CEO of SyfyLabs, Cengiz Han Sahin, told the publication that the author of Red Alert 2.0 is renting the Trojan for just $500.

In its blog post, SfyLabs researchers suggested that the malware includes a range of novel features to help keep the threat active. When the Trojan is unable to contact the C&C server, for example, it turns to Twitter and uses accounts on the social media platform to collect updated server information.

Even more worryingly, Red Alert 2.0 remains a work in progress. Actors who have developed the threat regularly add new features. One of the most recent additions is the ability to block incoming calls from banks, reported SecurityWeek, which means affected users cannot be told of errant activity.

How Can IT Managers Reduce the Risk?

Researchers suggested that growing numbers of threat actors who normally develop malware for desktop and Windows-based platforms are shifting their attention to Android. They attributed this shift to the growing prominence of mobile platforms for financial services transactions.

Users should note that the infected apps distributing Red Alert 2.0 were found on third-party Android app stores. The good news, if there is some, is that no app featuring the malware has been found on the official Google Play Store. The best advice for IT managers looking to reduce the risk is to ensure users avoid third-party app stores and to only download software from the Play Store.