Tag: stealing | Page 3

New Chameleon banking trojan is stealing account info — what you need to know

April 13, 2023/in Computer Security

A newly discovered Android banking trojan could be hiding among your other apps. One with the ability to change its app icon as it steals your passwords, text messages and other sensitive data.

According to a new report (opens in new tab) by the cybersecurity firm Cyble, security researchers discovered a new banking trojan that they have dubbed “Chameleon,” based on the commands used by the malware powering it.

The Chameleon banking trojan has been active since January of this year, and (like other Android malware) it abuses the operating system’s Accessibility Service to perform malicious activities. However, one thing that sets it apart from other banking trojans is the fact that Chameleon pretends to be other popular apps and can even change its icon to hide in plain sight.

So far, Cyble’s researchers have observed the banking trojan using the icons of ChatGPT, Chrome and other apps though it also uses pictures of popular cryptocurrencies like Bitcoin or Litecoin to disguise itself as well.

Stealing account info and disabling Google Play Protect

Based on Cyble’s investigation, it appears that malicious apps used to spread the Chameleon banking trojan are distributed through hacked websites, Discord attachments and Bitbucket hosting services.

Even though Chameleon is still relatively new and is in the early stages of development, it already has a wide range of malicious capabilities and the banking trojan can perform keylogging, launch overlay attacks, harvest SMS text messages, prevent itself from being uninstalled, steal cookies and automatically uninstall itself.

Another interesting capability already found in Chameleon is its lock grabber which can steal a victim’s device password.

One thing that makes this new malware strain particularly dangerous is that it can disable Google Play Protect on an infected smartphone. For those unfamiliar, Google Play Protect is Google’s own Android antivirus app which scans both your existing apps and any new apps you download for malware and removes them.

Another interesting capability already found in Chameleon is its lock grabber which can steal a victim’s device password. Surprisingly, the lock grabber can even identify whether…

Source…

Detroit man sentenced to prison for hacking into bank accounts, stealing $300K

April 8, 2023/in Computer Security

A Detroit man was sentenced to prison for stealing more than $300,000 from the bank accounts in a criminal enterprise, Michigan Attorney General Dana Nessel said Wednesday.

Johnny Richardson, 28, was sentenced to three to 20 years behind bars for conducting a criminal enterprise that included gaining cellphone data of victims and hacking into their bank accounts for money or to take out loans, according to Nessel’s office. Richardson will be required to pay for court costs, crime victim fees and $309,210 in restitution.

Richardson already is serving eight years in prison for operating an unemployment fraud scheme during the COVID-19 pandemic. He pleaded guilty in July 2021 to stealing $138,000 in COVID aid.

“Richardson, either himself or through others, filed fraudulent unemployment claims over the internet in at least five states resulting in the fraudulent disbursement of at least $683,555 of funds intended for unemployment assistance during the pandemic,” federal officials said in 2021.

During the $2.5 million unemployment scheme, Richardson was accused of allegedly providing information on Michigan claims to Brandi Hawkins, a former contract employee at Michigan’s Unemployment Insurance Agency.

“Hawkins subsequently used her insider access to fraudulently release payments on these claims,” according to the federal government.

The latest conviction of a criminal enterprise was the result of a joint investigation between the Attorney General’s Financial Crimes Division and the U.S. Postal Service.

Source…

Rilide malware is stealing 2FA codes and passwords — what you need to know

April 7, 2023/in Computer Security

Hackers are once again targeting Chromium-based browsers like Google Chrome, Microsoft Edge and others using a new malware strain designed to syphon off sensitive user data.

The malware itself has been dubbed Rilide by security researchers at Trustwave SpiderLabs who explained in a new report (opens in new tab) that it can carry out a wide range of malicious activities including monitoring browsing history, taking screenshots and stealing cryptocurrency using scripts injected into websites.

Although the Rilide malware is being spread through a fake Google Drive browser extension, the cybersecurity firm also discovered another campaign abusing Google Ads and the Aurora Stealer to load the extension using a Rust loader according to BleepingComputer (opens in new tab).

This could indicate that its creators are using a Malware-as-a-Service business model to sell Rilide to other cybercriminals who then use it in their own attacks since Trustwave did find a post on a hacking forum in March of last year advertising a botnet with similar capabilities.

Either way, Rilide is certainly a malware strain to look out for, especially since it’s able to intercept two-factor authentication (2FA) codes and take over both email and crypto accounts.

Hijacking Chromium-based browsers

The loader used by Rilide modifies the browser shortcut files in Chrome or Edge to automate the malicious browser extension dropped onto infected systems by the malware.

From here, it runs a script that monitors when a user infected by the malware switches tabs, receives content from the web or when a web page finishes loading. At the same time, it also checks if the website a user is on matches a list of targets on a command and control (C&C) server controlled by the hackers behind the campaign.

When one of the sites is a match, the malicious extension then loads additional scripts that are injected into a web page to steal sensitive information from victims related to crypto, their email account credentials and more.

The extension dropped by Rilide can even disable a security feature called “Content Security Policy” which is used to protect against cross site scripting (XSS) attacks. This allows it to load external…

Source…

Detroit man sentence to prison for hacking into bank accounts, stealing $300K

April 6, 2023/in Internet Security

A Detroit man was sentenced to prison for stealing more than $300,000 from the bank accounts in a criminal enterprise, Michigan Attorney General Dana Nessel said Wednesday.

Johnny Richardson, 28, was sentenced to three to 20 years behind bars for conducting a criminal enterprise that included gaining cellphone data of victims and hacking into their bank accounts for money or to take out loans, according to Nessel’s office. Richardson will be required to pay for court costs, crime victim fees and $309,210 in restitution.

Richardson already is serving eight years in prison for operating an unemployment fraud scheme during the COVID-19 pandemic. He pleaded guilty in July 2021 to stealing $138,000 in COVID aid.

“Richardson, either himself or through others, filed fraudulent unemployment claims over the internet in at least five states resulting in the fraudulent disbursement of at least $683,555 of funds intended for unemployment assistance during the pandemic,” federal officials said in 2021.

During the $2.5 million unemployment scheme, Richardson was accused of allegedly providing information on Michigan claims to Brandi Hawkins, a former contract employee at Michigan’s Unemployment Insurance Agency.

“Hawkins subsequently used her insider access to fraudulently release payments on these claims,” according to the federal government.

The latest conviction of a criminal enterprise was the result of a joint investigation between the Attorney General’s Financial Crimes Division and the U.S. Postal Service.

Source…

Tag Archive for: stealing