Security News > 2022 > March > Android malware Escobar steals your Google Authenticator MFA codes
The Aberebot Android banking trojan has returned under the name 'Escobar' with new features, including stealing Google Authenticator multi-factor authentication codes.
The malware author is renting the beta version of the malware for $3,000 per month to a maximum of five customers, with threat actors having the ability to test the bot for free for three days.
The malware also packs several other features that make it potent against any Android version, even if the overlay injections are blocked in some manner.
Everything that the malware collects is uploaded to the C2 server, including SMS call logs, key logs, notifications, and Google Authenticator codes.
It is still early to tell how popular the new Escobar malware will become in the cybercrime community, especially at a relatively high price.
In general, you can minimize the chances of being infected with Android trojans by avoiding the installation of APKs outside of Google Play, using a mobile security tool, and ensuring that Google Play Protect is enabled on your device.
News URL
Related news
- Google patches exploited Android zero-day on Pixel devices (source)
- Pakistan-linked Malware Campaign Evolves to Target Windows, Android, and macOS (source)
- Singapore Police Extradites Malaysians Linked to Android Malware Fraud (source)
- New Medusa malware variants target Android users in seven countries (source)
- Snowblind malware abuses Android security feature to bypass security (source)