IBM recently came across a complex new criminal scheme involving the Tatanga Trojan, which conducts an elaborate Man in the Browser (MitB) attack to bypass SMS-based transaction authorization to commit online banking fraud, compromising users’ mobile security.

Mobile Security Compromised

The scam targets the online banking customers of several German banks. When victims log on to the online banking application, Tatanga uses a MitB webinject that alleges that the bank is performing a security check on their computer and on their ability to receive a transaction authorization number (TAN) on their mobile device.

In the background, Tatanga initiates a fraudulent money transfer to a mule account. It even checks the victim’s account balance and will transfer funds from the account with the highest balance if there is more than one to choose from.

Victims are asked to enter the SMS-delivered TAN they receive from the bank into the fake Web form as a way to complete this security process. By entering the TAN in the injected HTML page, victims are in fact approving the fraudulent transaction originated by Tatanga against their account.

Even though victims are presented with the fund transfer amount and the destination account information in the SMS message that contains the TAN, the injected HTML page claims that the process uses “experimental” data and that no money will leave their account.

Wahrscheinlich haben sich in letzter Zeit einige Ver änderungen bei Ihrem Computer ergeben. Aus Sicherheitsgrü; nden m üssen Sie eine Tan eingeben, um zu bestä tigen, dass es Ihr Computer ist, damit Ihnen der Zugang gew ährt wird. Achtung: Sie haben nur einen Versuch! Sehr geehrter Nutzer von Online-Banking um die Sicherheit zu verbessern, unsere Bank prüft die Aktivierung der Rufnummern fur smsTAN aufgefuhrt. Sie schickte die Piloten SMS TAN, die Sie dazu aufgefordert zu bestätigen, dass die Telefonnummer aktiviert werden. Wenn Sie nicht in Kraft smsTAN Ihr Konto wird gesperrt, bis die Aktivierung Telefonnummer. Hinweis: SMS-Nachricht enthält die experimentellen Daten. Warnung! Der Sicherheitsdienst der Bank fuhrt Anlagenkontrolle durch, uberpruft die Korrektheit der Datenempfang auf das Handy der Kunde. Wahrend 5 Minuten bekommen Sie SMS mit den Daten der Uberweisung, dass bedeutet, das ein Handy ist zum Online-Banking eingeschaltet und korrekt funktioniert. SMS-Prufung wird kostenlos durchgefuhrt, es wird kein Geld vom Konto abgehebt. Die Bank pruft nur die Vereinbarkeit mit einem mobilen Gerat der Kunde

More Sophisticated Mobile Attacks

Once the victim enters the TAN in the fake form and hits submit, the funds are transferred to the fraudster’s account. Meanwhile, Tatanga modifies the account balance reports in the online banking application to hide the fraudulent transaction.

This is a very sophisticated and multifaceted attack. By combining an MitB attack with social engineering, Tatanga is able to circumvent most banks’ mobile security and out-of-band authentication. It then goes one step further by hiding evidence of the fraudulent transaction from the victim using a post-transaction attack mechanism. Fortunately, the text in the injected HTML page is littered with grammar and spelling mistakes and appears not to have been written by a German speaker; this may make it less effective.

Clearly, grammar is easy enough for these fraudsters to improve, but the fact that they are blending multiple attack methods in a single fraud scam is not good news. However, they still need to compromise the endpoint with malware, which can be prevented.

Old Techniques, New Channel: Mobile Malware Adapting PC Threat Techniques

More from Malware

ITG10 Likely Targeting South Korean Entities of Interest to the Democratic People’s Republic of Korea (DPRK)

7 min read - In late April 2023, IBM Security X-Force uncovered documents that are most likely part of a phishing campaign mimicking credible senders, orchestrated by a group X-Force refers to as ITG10, and aimed at delivering RokRAT malware, similar to what has been observed by others. ITG10's tactics, techniques and procedures (TTPs) overlap with APT37 and ScarCruft. The initial delivery method is conducted via a LNK file, which drops two Windows shortcut files containing obfuscated PowerShell scripts in charge of downloading a…

7 min read

Ransomware Renaissance 2023: The Definitive Guide to Stay Safer

2 min read - Ransomware is experiencing a renaissance in 2023, with some cybersecurity firms reporting over 400 attacks in the month of March alone. And it shouldn’t be a surprise: the 2023 X-Force Threat Intelligence Index found backdoor deployments — malware providing remote access — as the top attacker action in 2022, and aptly predicted 2022’s backdoor failures would become 2023’s ransomware crisis. Compounding the problem is the industrialization of the cybercrime ecosystem, enabling adversaries to complete more attacks, faster. Over the last…

2 min read

BlackCat (ALPHV) Ransomware Levels Up for Stealth, Speed and Exfiltration

9 min read - This blog was made possible through contributions from Kat Metrick, Kevin Henson, Agnes Ramos-Beauchamp, Thanassis Diogos, Diego Matos Martins and Joseph Spero. BlackCat ransomware, which was among the top ransomware families observed by IBM Security X-Force in 2022, according to the 2023 X-Force Threat Intelligence Index, continues to wreak havoc across organizations globally this year. BlackCat (a.k.a. ALPHV) ransomware affiliates' more recent attacks include targeting organizations in the healthcare, government, education, manufacturing and hospitality sectors. Reportedly, several of these incidents resulted…

9 min read

Ex-Conti and FIN7 Actors Collaborate with New Backdoor

15 min read -   April 27, 2023 Update This article is being republished with modifications from the original that was published on April 14, 2023, to change the name of the family of malware from Domino to Minodo. This is being done to avoid any possible confusion with the HCL Domino brand. The family of malware that is described in this article is unrelated to, does not impact, nor uses HCL Domino or any of its components in any way. The malware is…

15 min read