In addition to the huge threat banking Trojans already pose to financial firms, cybercriminals are now attaching file-encrypting ransomware programs to create a new level of danger for mobile users. Two banking Trojans, known as Faketoken and Tordow 2.0, have combined to both pilfer information and lock files on Android devices.

Cybercriminals continue to spread their ransomware techniques around the globe. IT decision-makers should be aware of the revised Trojans and ensure that Android applications on enterprise devices are used with care.

Faketoken and Tordow 2.0: A Dual Threat to Banks

The original purpose of the Faketoken Trojan was to create fake login screens so fraudsters could steal credentials through financial applications, according to CSO Online. The creators have now inserted the capability to encrypt files held on a phone’s SD card.

Researchers at Kaspersky Lab reported that the new version of Faketoken can steal credentials from more than 2,000 Android finance apps. They estimated that Faketoken has already affected more than 16,000 people in 27 countries.

Faketoken continually asks the user for permissions after it has been installed and tries to replace application shortcuts with substitute icons. The Register reported that malicious coders are probably using this method as the foundation for further damage.

The Root of the Problem

Meanwhile, Comodo Threat Research Labs recently discovered that another mobile banking Trojan known as Tordow 2.0 was affecting users in Russia. Tordow 2.0 is the first mobile banking Trojan that requests root privileges on infected Android devices.

Root access gives cybercriminals the ability to affect a series of functions, such as downloading programs, accessing contacts and renaming files. Although the majority of victims have been located in Russia so far, Comodo pointed out that successful cybercriminal techniques are often spread around the world.

Tordow 2.0 is being spread through popular social media and gaming apps that are impaired by malevolent coders. These hijacked apps are often disseminated from third-party sites that are not affiliated with official stores.

Busting Banking Trojans

The good news, according to the Kaspersky researchers, is that file encryption is not currently popular with mobile ransomware developers, perhaps due to the fact that files on mobile device are often copied to the cloud.

However, the revised versions of these Trojans provide more evidence as to why users should be careful when it comes to app permissions. In September, Kaspersky advised Android users to avoid installing apps from unofficial sources and to use antivirus tools to protect their devices.

Additionally, security researcher Graham Cluley suggested that Android users consider forgoing banking apps on their mobile devices altogether. Any malware would then be unable to steal sensitive data, he reasoned.

More from

Most organizations want security vendor consolidation

4 min read - Cybersecurity is complicated, to say the least. Maintaining a strong security posture goes far beyond knowing about attack groups and their devious TTPs. Merely understanding, coordinating and unifying security tools can be challenging.We quickly passed through the “not if, but when” stage of cyberattacks. Now, it’s commonplace for companies to have experienced multiple breaches. Today, cybersecurity has taken a seat in core business strategy discussions as the risks and costs have risen dramatically.For this reason, 75% of organizations seek to…

How IBM secures the U.S. Open

2 min read - More than 15 million tennis fans around the world visited the US Open app and website this year, checking scores, poring over statistics and watching highlights from hundreds of matches over the two weeks of the tournament. To help develop this world-class digital experience, IBM Consulting worked closely with the USTA, developing powerful generative AI models that transform tennis data into insights and original content. Using IBM watsonx, a next-generation AI and data platform, the team built and managed the entire…

How the FBI Fights Back Against Worldwide Cyberattacks

5 min read - In the worldwide battle against malicious cyberattacks, there is no organization more central to the fight than the Federal Bureau of Investigation (FBI). And recent years have proven that the bureau still has some surprises up its sleeve. In early May, the U.S. Department of Justice announced the conclusion of a U.S. government operation called MEDUSA. The operation disrupted a global peer-to-peer network of computers compromised by malware called Snake. Attributed to a unit of the Russian government Security Service,…

How NIST Cybersecurity Framework 2.0 Tackles Risk Management

4 min read - The NIST Cybersecurity Framework 2.0 (CSF) is moving into its final stages before its 2024 implementation. After the public discussion period to inform decisions for the framework closed in May, it’s time to learn more about what to expect from the changes to the guidelines. The updated CSF is being aligned with the Biden Administration’s National Cybersecurity Strategy, according to Cherilyn Pascoe, senior technology policy advisor with NIST, at the 2023 RSA Conference. This sets up the new CSF to…