In addition to the huge threat banking Trojans already pose to financial firms, cybercriminals are now attaching file-encrypting ransomware programs to create a new level of danger for mobile users. Two banking Trojans, known as Faketoken and Tordow 2.0, have combined to both pilfer information and lock files on Android devices.

Cybercriminals continue to spread their ransomware techniques around the globe. IT decision-makers should be aware of the revised Trojans and ensure that Android applications on enterprise devices are used with care.

Faketoken and Tordow 2.0: A Dual Threat to Banks

The original purpose of the Faketoken Trojan was to create fake login screens so fraudsters could steal credentials through financial applications, according to CSO Online. The creators have now inserted the capability to encrypt files held on a phone’s SD card.

Researchers at Kaspersky Lab reported that the new version of Faketoken can steal credentials from more than 2,000 Android finance apps. They estimated that Faketoken has already affected more than 16,000 people in 27 countries.

Faketoken continually asks the user for permissions after it has been installed and tries to replace application shortcuts with substitute icons. The Register reported that malicious coders are probably using this method as the foundation for further damage.

The Root of the Problem

Meanwhile, Comodo Threat Research Labs recently discovered that another mobile banking Trojan known as Tordow 2.0 was affecting users in Russia. Tordow 2.0 is the first mobile banking Trojan that requests root privileges on infected Android devices.

Root access gives cybercriminals the ability to affect a series of functions, such as downloading programs, accessing contacts and renaming files. Although the majority of victims have been located in Russia so far, Comodo pointed out that successful cybercriminal techniques are often spread around the world.

Tordow 2.0 is being spread through popular social media and gaming apps that are impaired by malevolent coders. These hijacked apps are often disseminated from third-party sites that are not affiliated with official stores.

Busting Banking Trojans

The good news, according to the Kaspersky researchers, is that file encryption is not currently popular with mobile ransomware developers, perhaps due to the fact that files on mobile device are often copied to the cloud.

However, the revised versions of these Trojans provide more evidence as to why users should be careful when it comes to app permissions. In September, Kaspersky advised Android users to avoid installing apps from unofficial sources and to use antivirus tools to protect their devices.

Additionally, security researcher Graham Cluley suggested that Android users consider forgoing banking apps on their mobile devices altogether. Any malware would then be unable to steal sensitive data, he reasoned.

More from

Will the 2.5M Records Breach Impact Student Loan Relief?

Over 2.5 million student loan accounts were breached in the summer of 2022, according to a recent Maine Attorney General data breach notification. The target of the breach was Nelnet Servicing, a servicing system and web portal provider for the Oklahoma Student Loan Authority (OSLA) and EdFinancial. An investigation determined that intruders accessed student loan account registration information between June and July 2022. The stolen data includes names, addresses, emails, phone numbers and social security numbers for 2,501,324 student loan…

Containers, Security, and Risks within Containerized Environments

Applications have historically been deployed and created in a manner reminiscent of classic shopping malls. First, a developer builds the mall, then creates the various stores inside. The stores conform to the dimensions of the mall and operate within its floor plan. In older approaches to application development, a developer would have a targeted system or set of systems for which they intend to create an application. This targeted system would be the mall. Then, when building the application, they would…

Inside the Second White House Ransomware Summit

Ransomware is a growing, international threat. It's also an insidious one. The state of the art in ransomware is simple but effective. Well-organized criminal gangs hiding in safe-haven countries breach an organization, find, steal and encrypt important files. Then they present victims with the double incentive that, should they refuse to pay, their encrypted files will be both deleted and made public. In addition to hundreds of major attacks around the world, two critical ransomware incidents — the Colonial Pipeline…

Did Brazil DSL Modem Attacks Change Device Security?

From 2011 to 2012, millions of Internet users in Brazil fell victim to a massive attack against vulnerable DSL modems. By configuring the modems remotely, attackers could redirect users to malicious domain name system (DNS) servers. Victims trying to visit popular websites (Google, Facebook) were instead directed to imposter sites. These rogue sites then installed malware on victims' computers. According to a report from Kaspersky Lab Expert Fabio Assolini citing statistics from Brazil's Computer Emergency Response Team, the attack ultimately…