Security News > 2023 > July > New Android malware uses OCR to steal credentials from images
Two new Android malware families named 'CherryBlos' and 'FakeTrade' were discovered on Google Play, aiming to steal cryptocurrency credentials and funds or conduct scams.
The malicious apps use various distribution channels, including social media, phishing sites, and deceitful shopping apps on Google Play, Android's official app store.
CherryBlos uses a range of tactics to steal cryptocurrency credentials and assets, with the main tactic being to load fake user interfaces that mimic official apps to phish for credentials.
Trend Micro analysts found connections to a campaign on Google Play, where 31 scam apps collectively called "FakeTrade" were using the same C2 network infrastructures and certificates as the CherryBlos apps.
Google told BleepingComputer that the reported malware apps had been removed from Google Play.
Anatsa Android trojan now steals banking info from users in US, UK. SpinOk Android malware found in more apps with 30 million installs.
News URL
Related news
- Android malware 'Necro' infects 11 million devices via Google Play (source)
- Necro malware continues to haunt side-loaders of dodgy Android mods (source)
- New Octo Android malware version impersonates NordVPN, Google Chrome (source)
- Necro Android Malware Found in Popular Camera and Browser Apps on Play Store (source)
- TrickMo malware steals Android PINs using fake lock screen (source)
- Russia targets Ukrainian conscripts with Windows, Android malware (source)
- Android malware "FakeCall" now reroutes bank calls to attackers (source)
- New FakeCall Malware Variant Hijacks Android Devices for Fraudulent Banking Calls (source)
- New Android Banking Malware 'ToxicPanda' Targets Users with Fraudulent Money Transfers (source)
- Cyber crooks push Android malware via letter (source)