A banking trojan that stole users’ passwords and data was recently discovered on Google Play by Cleafy, the online fraud management and prevention solution. The company’s latest report found that the so-called TeaBot banking trojan (or Anatsa and Toddler) is targeting European banks to steal two-factor authentication codes via text. The malware has further evolved to target users in the US, Hong Kong and Russia.  Previously the trojan was being delivered as a fake in-app update. An app called QR Code & Barcode – Scanner scored over 10,000 downloads and while it looks like a legitimate app, it does request permission to download a second app called QR Code Scanner: Add-On which then carries the bot.  Google removed the app from Play.
The post Google Play banking trojan stole user data and passwords appeared first on Business of Apps.

Google Play banking trojan stole user data and passwords

Advertisement
Just a couple of weeks after we came across an Android banking malware known as Xenomorph , a new report is shedding light on another Remote Access Trojan (RAT) for Android known as “TeaBot.”
According to cybersecurity firm Cleafy , the TeaBot trojan was hiding within an app called “QR Code & Barcode – Scanner,” which has seen thousands of downloads on the Google Play Store . The TeaBot malware intends to steal unsuspecting users’ financial credentials and other information via texts (SMS), Cleafy claims. Thankfully, Google has since removed the app. However, Tom’s Guide claims that the company took its sweet time to remove it. To make matters worse, the app’s reviews were reportedly positive at the time of its removal, thus tricking innocent users into downloading the app. Advertisement
The TeaBot malware can also bypass two-factor authentication or 2FA
This either means the reviews were fake or that the developers ensured the app looked as convincing as possible. A closer look at the screenshots shared by Cleafy suggests it’s the former. One of the first reviews from the now removed app is clearly for a bar and not a barcode scanner. “This bar is brilliant, has been since they reopened & continues to maintain high standards of sanitizing,” the review says. Moreover, the app developer is named “QR BarCode Scanner Bussiness LLC,” which raises several red flags. But it’s clear that despite all these warning signs, many users have fallen prey to this malware. The maneuvers of this malicious app can also bypass 2FA security by gaining access and control of the screen. This is possible by installing a fake update containing TeaBot by requesting the Accessibility Services permission to receive access to the screen and other device functions. Advertisement
If you’ve downloaded this app, you could be at risk
If you’ve downloaded this malicious app in the past, we suggest getting in touch with your bank to spot any irregularities. Cleafy said the TeaBot trojan mainly affected banks and customers across the U.S., Hong Kong, and Europe. A handful of cryptocurrency wallets and exchange services were also impacted. With the app now removed from the Play Store, there’s no concern about the app spreading further. However, customers who still have the app are still at risk. Keeping this in mind, we strongly recommend removing this particular app from your devices right away. As Phone Arena points out, customers who use QR code scanner apps from developers like Simple Design and Gamma Play are safe. Share this page

TeaBot Malware Spotted Stealing Android Users' Bank Information

Criminals have managed to successfully hide a banking Trojan on the Google Play Store, possibly infecting thousands of devices in an attempt to steal identities and two-factor authentication codes. A new report from security firm Cleafy found thatTeaBot banking trojan, sometimes referred to as Anatsa, or Toddler, was being distributed as a second-stage payload from a […]
The post This data-stealing Android app has been downloaded thousands of times – TechRadar appeared first on Business Telegraph.

This data-stealing Android app has been downloaded thousands of times – TechRadar

Posted On:
It seems that criminals have successfully hidden a banking Trojan on the Google Play Store, potentially infecting tens of thousands of devices in an effort to steal identities and two-factor authentication tokens. The TeaBot banking trojan, also known as Anatsa or Toddler, was discovered to be spread as a second-stage payload via an apparently genuine programme, according to a recent research from security company Cleafy . An update to a non-malicious, fully functional programme named “QR Code & Barcode – Scanner” was discovered to be distributing the malicious code. As a result, the app has earned multiple excellent ratings on the Play Store for its ability to read barcodes and QR codes. Payload delivery
If you don’t already have the “QR Code Scanner: Add-on,” you’ll need to download it as soon as you install the app, according to the newspaper. Before it was taken down from the app store for what it really was, the app had over 10,000 downloads. By downloading the “add-on,” a victim will be given the option of giving TeaBot access to their screen, which it will then exploit to steal their login credentials and other forms of authentication such as two-factor SMS codes or two-factor two-factor codes. Using Android accessibility services, it is able to capture keystrokes as well. A malicious app may be almost undetected by antivirus software since it demands just a few permissions from the official Google Play Store and the malicious app is downloaded at a later time, Cleafy said. Google did not comment on the results, but it did delete the programme from the Google Play store. ‘
First identified in May of last year, TeaBot was taking two-factor codes provided through SMS to European banks. Cleafy claims that this time, it is aimed at Russian, Hong Kong, and American users.

Hundreds of thousands of people have downloaded this data-stealing Android app

The TeaBot banking trojan: A data theft app found on google play is downloaded thousands of times. Data theft relates to an unauthorized person gaining access to your laptop and stealing information, accessing email accounts or computer networks, and sending an email with personal data to the wrong person. It’s also known as information theft. This could include illegal transfer or storage of personal, confidential, or financial information such as passwords, software code, or algorithms. It is growing day by day. Data theft also refers to cybercrime. Now it is found that the data-stealing app, Teabot found on the Google play store is downloaded more than 10,000 times. A notorious Android banking trojan designed to steal user data, like passwords and text messages, has been discovered on Google Play . And to make matters worse the android trojan has been downloaded thousands of times. Data stealing apps like Trojans and Malware apps re been used frequently since the pandemic. A new Data Stealing app on Google Play:
The TeaBot banking trojan was first observed in 2021targeting European banks by stealing two-factor authentication codes sent by text message. It’s also known as Anatsa and Toddler. ‘An online fraud management and prevention solution, present malware scams evolved to disturb Russia, Hong Kong, and the United States via a second-stage malicious payload’ says a new report by Cleafy. It says that the malware was previously distributed through SMS-based phishing campaigns using a number of common apps as lures, such as TeaTV, VLC Media Player, and shipping apps like DHL and UPS. Researchers say that the malicious Google Play app was acting as a “dropper”, that delivered TeaBot by way of a fake in-app update. Droppers are apps that appear legitimate, but in fact, deliver a second-stage malicious payload. When you download the QR Code & Barcode Scanner app it looks and feels 100% legit. But when you start using it immediately request permission to download a second application. As the QR code & Barcode Scanner app offers the promised functionality, nearly all of the app’s reviews are positive. The QR Code & Barcode Scanner immediately requests permission to download a second application, “QR Code Scanner: Add-On,” which includes multiple TeaBot samples. Once installed, TeaBot asks for permissions to view and control the device’s screen to retrieve sensitive information such as login credentials, SMS messages, and two-factor codes. It also abuses Android’s accessibility service, similar to other malicious Android apps, to request permissions that allow the malware to record keyboard entries. Cleafy warns that when the official Google Play Store requests only permission and the malicious app is downloaded at a later time here the dropper application is distributed. It is able to get mask itself as a legitimate application and it is almost undetectable by common antivirus solutions. Cleafy says TeaBot is now targeting over 400 applications, including home banking apps, insurance apps, crypto wallets, and crypto exchanges, an increase in more than 500% in attacks in less than a year. But now this app is removed from google play. It is recommended that you steer clear of apps that behave in a similar manner. It is vital that you protect yourself and your info.

Data Theft App, TeaBot Downloaded 1,000 Times From Google Play

PoliHub

GE Healthcare

Accenture

Politecnico di Milan

Other Investors

Cleafy is a network security software developer which helps protect web and mobile applications from tampering attempts and deploys countermeasures to guarantee data and content integrity. It is based in Milan, Italy.

Name	Work History	Title	Status
Matteo Bogana	PoliHub, GE Healthcare, and Accenture	Founder, Chief Executive Officer	Current
Carmine Giangregorio		Founder	Current
Nicolò Pastore	Politecnico di Milan	Founder, Chief Technology Officer	Current

Name	Matteo Bogana	Carmine Giangregorio	Nicolò Pastore
Work History	PoliHub, GE Healthcare, and Accenture		Politecnico di Milan
Title	Founder, Chief Executive Officer	Founder	Founder, Chief Technology Officer
Status	Current	Current	Current

Wells Fargo Success Story

3M Success Story

Platform Overview

Cleafy

Executives

Cleafy Management Team

3 Team Members

Discover the right solution for your team