Security researchers at ThreatFabric have been closely monitoring the infrastructure of a new Android malware called Manic for some time. The malicious code is installed on at least 169 different applications, including mobile banking, digital identity services, crypto wallets, two-factor authentication applications, and even military and business communication applications. The main focus of the attacks is in Ukraine, but banking applications from a number of European countries, such as Germany, France, Austria, Poland, and other markets, are also among the targets.<\/p>\n\n\n\n
Manic combines two areas that usually operate separately: bank fraud and direct espionage. The program can track the location of the device, read notifications, view files and remotely control the phone. The virus spreads through container applications that use names similar to system components of established manufacturers. The latest versions load the code directly into memory and skillfully hide from the list of installed applications.<\/p>\n\n\n\n
The PIN interception technique is particularly sophisticated. Instead of displaying fake login pages, the malicious code places a transparent layer over the numeric keypads of the targeted applications. It accurately records every touch on the screen, then abuses accessibility services and repeats the same tap so that the legitimate application works without any noticeable interference. In addition, the malicious code can automatically test already saved passwords on the lock screen. It sorts all entered characters by type on the fly, distinguishing between crypto wallet security words, SMS codes, passwords and regular messages. Attackers can also control the device live via WebRTC and monitor the image from the camera or screen, while showing the user a black screen or fake updates.<\/p>\n\n\n\n
The most unusual part of the system is the transmission of stolen information. If the infected phone does not have access to the Internet, it encrypts the stolen data with the AES-GCM algorithm and stores it in a local queue. It then uses Wi-Fi Direct or Bluetooth to find other infected devices nearby and transmits the encrypted packet to them, which then travels up to four intermediate hops to the control server.<\/p>\n\n\n\n
Disconnecting the device from the network will not prevent data leakage if another infected phone is nearby. The basic protection therefore remains to consistently avoid installing APK files from unverified sources and be cautious when granting extensive system permissions.<\/p>","protected":false},"excerpt":{"rendered":"
Varnostni raziskovalci podjetja ThreatFabric \u017ee dlje \u010dasa podrobno spremljajo infrastrukturo novega \u0161kodljivega programa za operacijski sistem Android, imenovanega Manic. Zlonamerna koda je name\u0161\u010dena na vsaj 169 razli\u010dnih aplikacij, med katerimi so mobilne banke, storitve digitalne identitete, kripto denarnice, aplikacije za dvostopenjsko preverjanje ter celo voja\u0161ki in poslovni komunikacijski programi. Glavno \u017eari\u0161\u010de napadov je v Ukrajini, […]<\/p>","protected":false},"author":2,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[50],"tags":[128,478,482],"class_list":["post-8065","post","type-post","status-publish","format-standard","hentry","category-telefonija","tag-android","tag-informacijska-varnost","tag-kibernetska-varnost"],"acf":{"subtitle":"","heading":"","summary":"Nova \u0161kodljiva koda za Android brez internetne povezave lahko ukradene podatke prepo\u0161lje prek Bluetootha ali Wi-Fi Direct povezave na druge blizu le\u017ee\u010de oku\u017eene telefone.","thumbnail_small":"https:\/\/racunalniske-novice.com\/wp-content\/uploads\/2020\/09\/280920_alienmalware-560x315.jpg","thumbnail_large":"https:\/\/racunalniske-novice.com\/wp-content\/uploads\/2020\/09\/280920_alienmalware.jpg","thumbnail_caption":"Na va\u0161o mobilno napravo Android vedno name\u0161\u010dajte zgolj aplikacije, ki jih potrebujete in zgolj iz uradnih mest.","gallery":"","video_gallery":null,"author":"","links":null,"sources":[{"title":"hwupgrade","url":"https:\/\/www.hwupgrade.it\/news\/sicurezza-software\/un-malware-android-trafuga-i-dati-anche-a-telefono-scollegato-rimbalzando-fra-i-vicini_158023.html"}],"skip_language":[]},"yoast_head":"\n