Google Removes Malware Infected Two-Factor Authentication App Stealing Banking Details From Play Store
The app was removed after it accumulated over 10,000 downloads on the Play Store.
Advertisement
By David Delima | Updated: 1 February 2022 14:59 IST
Highlights
The 2FA Authenticator app was infected with the Vultr malware
It is capable of recording the screen when a banking app is used
The malware mimicked an open-source two-factor authentication app
Users who installed the infected app will have to manually remove it from their devices
Photo Credit: Pixabay/ andrekheren
Two-factor authentication is widely considered one of the best ways of securing accounts online, but a fraudulent application posing as one was recently caught stealing financial information of users on Android smartphones. A security firm discovered that the app was posing as an open-source application that offers the same functionality. The two-factor authentication app, which was infected with a nefarious banking trojan, was downloaded over 10,000 times before it was removed by Google in the latest example of malicious developers finding new ways to steal user information.
The ‘2FA Authenticator' app was recently identified as malware by researchers from security firm Pradeo and contains the dangerous Vultur Android malware. Attackers that infect Android devices with the Vultur malware can use remote access software to mirror a user's screen and steal login credentials. The malware was first discovered last year and is able to record a smartphone's screen while finance-related apps are being used.
The listing for the app on the Google Play store, which is currently unavailable Photo Credit: Screenshot/ Google Play
According to the researchers, the 2FA Authenticator app is designed to mimic the interface of the open-source Aegis Authenticator application, in order to maintain a low profile. It attacks users devices in two stages. The application's malicious code allows it to collect and transmit a list of the applications installed on a users phone and their location, and then use attacks at applications used in those regions. It is also capable of disabling the phone's PIN or password and downloading third-party apps under the guise of providing updates.
After identifying the user's region, the malware installs the Vultur malware, which can use remote screen access to steal user credentials from a user's smartphone when banking and cryptocurrency applications are opened. The malware can also perform activities when the app is closed and takes advantage of a critical permission called SYSTEM_ALERT_WINDOW to overlay applications on the smartphone. The application spent 15 days on the Google Play store where it racked up over 10,000 downloads, before it was removed by Google. However, users who have the app installed on their device should remove the app immediately, according to the researchers.
SparkCat Crypto Stealer Malware Infected Multiple Apps on Play Store, App Store6 February 2025
Search
![Gadgets 360 With Technical Guruji: News of the Week [April 12, 2024]](https://c.ndtvimg.com/2025-04/jlpk5kco_news-of-the-week_160x120_12_April_25.jpg?downsize=180:*)
