In addition to the huge threat banking Trojans already pose to financial firms, cybercriminals are now attaching file-encrypting ransomware programs to create a new level of danger for mobile users. Two banking Trojans, known as Faketoken and Tordow 2.0, have combined to both pilfer information and lock files on Android devices.

Cybercriminals continue to spread their ransomware techniques around the globe. IT decision-makers should be aware of the revised Trojans and ensure that Android applications on enterprise devices are used with care.

Faketoken and Tordow 2.0: A Dual Threat to Banks

The original purpose of the Faketoken Trojan was to create fake login screens so fraudsters could steal credentials through financial applications, according to CSO Online. The creators have now inserted the capability to encrypt files held on a phone’s SD card.

Researchers at Kaspersky Lab reported that the new version of Faketoken can steal credentials from more than 2,000 Android finance apps. They estimated that Faketoken has already affected more than 16,000 people in 27 countries.

Faketoken continually asks the user for permissions after it has been installed and tries to replace application shortcuts with substitute icons. The Register reported that malicious coders are probably using this method as the foundation for further damage.

The Root of the Problem

Meanwhile, Comodo Threat Research Labs recently discovered that another mobile banking Trojan known as Tordow 2.0 was affecting users in Russia. Tordow 2.0 is the first mobile banking Trojan that requests root privileges on infected Android devices.

Root access gives cybercriminals the ability to affect a series of functions, such as downloading programs, accessing contacts and renaming files. Although the majority of victims have been located in Russia so far, Comodo pointed out that successful cybercriminal techniques are often spread around the world.

Tordow 2.0 is being spread through popular social media and gaming apps that are impaired by malevolent coders. These hijacked apps are often disseminated from third-party sites that are not affiliated with official stores.

Busting Banking Trojans

The good news, according to the Kaspersky researchers, is that file encryption is not currently popular with mobile ransomware developers, perhaps due to the fact that files on mobile device are often copied to the cloud.

However, the revised versions of these Trojans provide more evidence as to why users should be careful when it comes to app permissions. In September, Kaspersky advised Android users to avoid installing apps from unofficial sources and to use antivirus tools to protect their devices.

Additionally, security researcher Graham Cluley suggested that Android users consider forgoing banking apps on their mobile devices altogether. Any malware would then be unable to steal sensitive data, he reasoned.