Security Advisor

Windows Malware Targeting Android Banking Apps

While malware moving from mobile devices to PCs have become the norm, malware moving in the opposite direction looks to be a new attacker trick.

A new Windows malware is making the rounds that can infect Android devices connected to the PC.

According to security firm Symantec, who discovered and recently detailed the malware in a blog post,  the malicious software has been targeting users of South Korean banking apps. Called Trojan.Droidpak, the app makes the jump from a Windows-based PC to the phone when connected via USB.

Once an Android device with USB debugging enabled (necessary for the malware to make the jump) is connected to the infected computer, the malware located in Windows executes and installs a harmful .apk file. After installation is completed, the hidden app will scan the device and, if a targeted South Korean banking app is found, the device will prompt users to update. Instead of updating through either Google's app store or directly from the bank, the malware will delete the app and install malicious copies of the bank apps that will monitor online banking activity and intercept and reroute SMS messages sent to and from the financial institutions.

Symantec said that this malware is unique due to the fact that it's moving from Windows to a connected device, instead of the other way around.

"We've seen Android malware that attempts to infect Windows systems before," wrote Symantec's Flora Liu. "Android.Claco, for instance, downloads a malicious PE file along with an autorun.inf file and places them in the root directory of the SD card. When the compromised mobile device is connected to a computer in USB mode, and if the AutoRun feature is enabled on the computer, Windows will automatically execute the malicious PE file."

While this particular threat has only been used to target a specific audience in South Korea, with anything "new" in the hacking community, this unique type of threat won't stay unique for long. To avoid what may be making its way through the pipeline with regards to this specific type of attack, Symantec recommends the following:

  • Disable USB debugging when not in use.
  • Avoid connecting mobile devices to public or unknown PCs.
  • Install and make sure to keep updated mobile security software.

About the Author

Chris Paoli is the site producer for Redmondmag.com and MCPmag.com.

Featured

  • Microsoft Previews Windows VM Authentications via Azure Active Directory

    Microsoft on Thursday announced a preview of remote authentications into Windows-based Azure virtual machines (VMs) using Azure AD credentials.

  • Windows Server 20H1 Getting Smaller Containers and Faster PowerShell

    Microsoft is promising to deliver a smaller container size and improved PowerShell performance with its next release of Windows Server.

  • Microsoft Previews Microsoft Teams for Linux

    Microsoft on Tuesday announced a "limited preview" release of Microsoft Teams for certain Linux desktop operating systems.

  • Hyper-V Architecture: Some Clarifications

    Brien answers two thought-provoking reader questions. First, do Hyper-V VMs have direct hardware access? And second, how is it possible to monitor VM resource consumption from the host operating system?

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.