Security News > 2023 > July > New Android malware uses OCR to steal credentials from images
Two new Android malware families named 'CherryBlos' and 'FakeTrade' were discovered on Google Play, aiming to steal cryptocurrency credentials and funds or conduct scams.
The malicious apps use various distribution channels, including social media, phishing sites, and deceitful shopping apps on Google Play, Android's official app store.
CherryBlos uses a range of tactics to steal cryptocurrency credentials and assets, with the main tactic being to load fake user interfaces that mimic official apps to phish for credentials.
Trend Micro analysts found connections to a campaign on Google Play, where 31 scam apps collectively called "FakeTrade" were using the same C2 network infrastructures and certificates as the CherryBlos apps.
Google told BleepingComputer that the reported malware apps had been removed from Google Play.
Anatsa Android trojan now steals banking info from users in US, UK. SpinOk Android malware found in more apps with 30 million installs.
News URL
Related news
- Android malware "FakeCall" now reroutes bank calls to attackers (source)
- New FakeCall Malware Variant Hijacks Android Devices for Fraudulent Banking Calls (source)
- New Android Banking Malware 'ToxicPanda' Targets Users with Fraudulent Money Transfers (source)
- Cyber crooks push Android malware via letter (source)
- Warning: DEEPDATA Malware Exploiting Unpatched Fortinet Flaw to Steal VPN Credentials (source)
- Google's New Restore Credentials Tool Simplifies App Login After Android Migration (source)
- SpyLoan Android malware on Google play installed 8 million times (source)
- 8 Million Android Users Hit by SpyLoan Malware in Loan Apps on Google Play (source)
- New DroidBot Android banking malware spreads across Europe (source)
- New DroidBot Android malware targets 77 banking, crypto apps (source)