Godfather Android Malware Targets 400+ Banks and Crypto Exchanges
After fading absent for many months, the recently common Godfather Android malware is back again with a vengeance, focusing on additional than 400 worldwide economical corporations. The trojan generates pretend login web pages to harvest consumer login details, and which is just the get started. Godfather also mimics Google’s pre-set up security resources in an attempt to gain entire management in excess of units.
Godfather was uncovered by malware analytics business Group I-B, with the to start with samples showing up in June 2021. It is believed this malware grew out of yet another popular lender hacker regarded as Anubis. Godfather circulated at lower concentrations right until June 2022, when it vanished. It seems the operators had been simply just preparing a new variation. Godfather was back again with a vengeance in September of this 12 months, focusing on a whopping 400 economical companies: 215 global banking companies, 94 cryptocurrency wallets, and 110 crypto exchanges.
When set up on a system, Godfather will crank out fake login web pages, which it can use to get usernames and passwords. Many banking institutions and crypto companies have more login prerequisites, and which is wherever Godfather’s other mechanisms come in handy. Right after set up, the malware masquerades as a Google Play Shield warn. Imagining this is a legitimate popup from Android’s default protection suite, some people will grant the malware accessibility handle. At that point, Godfather can file the display screen, examine SMS, fire off faux notifications, make phone calls, and more — anything you have to have to compromise a lender account or crypto vault.
Godfather’s phony Perform Secure popup.
The malware appears to be spreading via decoy applications in the Engage in Retail store. Team I-B has not identified who created and gains from Godfather, but it seriously suspects that they are Russian speakers. There’s a kill swap in the malware that checks the OS language placing. If it finds the default language is 1 of all those spoken in previous Soviet states (other than Ukrainian), it will shut down alternatively of thieving data. It is not exactly a smoking gun, but it’s really suspicious.
Following evaluating Telegram channels, Team I-B believes that Godfather is an case in point of Malware-as-a-Provider (MaaS). The creators primarily license the malware to third functions, which can provide them juicy economical facts without the need of the inconvenience of producing the malware and infrastructure. It targets institutions all around the globe, which include the US (49 web pages), Turkey (31), Spain (30), and Canada (22). If you think you have been infected, remove accessibility from all mounted apps (ordinarily under Configurations > Accessibility) and alter your crucial passwords utilizing a various machine.
Now read:
