December 22, 2016 By Mark Samuels 2 min read

In addition to the huge threat banking Trojans already pose to financial firms, cybercriminals are now attaching file-encrypting ransomware programs to create a new level of danger for mobile users. Two banking Trojans, known as Faketoken and Tordow 2.0, have combined to both pilfer information and lock files on Android devices.

Cybercriminals continue to spread their ransomware techniques around the globe. IT decision-makers should be aware of the revised Trojans and ensure that Android applications on enterprise devices are used with care.

Faketoken and Tordow 2.0: A Dual Threat to Banks

The original purpose of the Faketoken Trojan was to create fake login screens so fraudsters could steal credentials through financial applications, according to CSO Online. The creators have now inserted the capability to encrypt files held on a phone’s SD card.

Researchers at Kaspersky Lab reported that the new version of Faketoken can steal credentials from more than 2,000 Android finance apps. They estimated that Faketoken has already affected more than 16,000 people in 27 countries.

Faketoken continually asks the user for permissions after it has been installed and tries to replace application shortcuts with substitute icons. The Register reported that malicious coders are probably using this method as the foundation for further damage.

The Root of the Problem

Meanwhile, Comodo Threat Research Labs recently discovered that another mobile banking Trojan known as Tordow 2.0 was affecting users in Russia. Tordow 2.0 is the first mobile banking Trojan that requests root privileges on infected Android devices.

Root access gives cybercriminals the ability to affect a series of functions, such as downloading programs, accessing contacts and renaming files. Although the majority of victims have been located in Russia so far, Comodo pointed out that successful cybercriminal techniques are often spread around the world.

Tordow 2.0 is being spread through popular social media and gaming apps that are impaired by malevolent coders. These hijacked apps are often disseminated from third-party sites that are not affiliated with official stores.

Busting Banking Trojans

The good news, according to the Kaspersky researchers, is that file encryption is not currently popular with mobile ransomware developers, perhaps due to the fact that files on mobile device are often copied to the cloud.

However, the revised versions of these Trojans provide more evidence as to why users should be careful when it comes to app permissions. In September, Kaspersky advised Android users to avoid installing apps from unofficial sources and to use antivirus tools to protect their devices.

Additionally, security researcher Graham Cluley suggested that Android users consider forgoing banking apps on their mobile devices altogether. Any malware would then be unable to steal sensitive data, he reasoned.

More from

CVE-2023-20078 technical analysis: Identifying and triggering a command injection vulnerability in Cisco IP phones

7 min read - CVE-2023-20078 catalogs an unauthenticated command injection vulnerability in the web-based management interface of Cisco 6800, 7800, and 8800 Series IP Phones with Multiplatform Firmware installed; however, limited technical analysis is publicly available. This article presents my findings while researching this vulnerability. In the end, the reader should be equipped with the information necessary to understand and trigger this vulnerability.Vulnerability detailsThe following Cisco Security Advisory (Cisco IP Phone 6800, 7800, and 8800 Series Web UI Vulnerabilities - Cisco) details CVE-2023-20078 and…

X-Force data reveals top spam trends, campaigns and senior superlatives in 2023

10 min read - The 2024 IBM X-Force Threat Intelligence Index revealed attackers continued to pivot to evade detection to deliver their malware in 2023. The good news? Security improvements, such as Microsoft blocking macro execution by default starting in 2022 and OneNote embedded files with potentially dangerous extensions by mid-2023, have changed the threat landscape for the better. Improved endpoint detection also likely forced attackers to shift away from other techniques prominent in 2022, such as using disk image files (e.g. ISO) and…

The compelling need for cloud-native data protection

4 min read - Cloud environments were frequent targets for cyber attackers in 2023. Eighty-two percent of breaches that involved data stored in the cloud were in public, private or multi-cloud environments. Attackers gained the most access to multi-cloud environments, with 39% of breaches spanning multi-cloud environments because of the more complicated security issues. The cost of these cloud breaches totaled $4.75 million, higher than the average cost of $4.45 million for all data breaches.The reason for this high cost is not only the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today