Vultur banking malware for Android poses as McAfee Security app

Security researchers found a new version of the Vultur banking trojan for Android that includes more advanced remote control capabilities and an improved evasion mechanism. Researchers at fraud detection company ThreatFabric first documented the malware in March 2021, and in late 2022, they observed it being distributed over Google Play through dropper apps. At the end of 2023, mobile security platform Zimperium included Vultur in its top 10 most active banking trojans for the year, noting that nine of its variants targeted 122 banking apps in 15 countries. A report from Fox-IT, part of the NCC Group, warns that a new, more evasive version of Vultur spreads to victims through a hybrid attack that relies on smishing (SMS phishing) and phone calls that trick the targets into installing a version of the malware that masquerades as the McAfee Security app. Vultur’s latest infection chain starts with the victim receiving an SMS message alerting of an unauthorized transaction and instructing to call a provided number for guidance. The call is answered by a fraudster who persuades the victim to open the link arriving with a second SMS, which directs to a site that offers a modified version of the McAfee Security app Inside the trojanized McAfee Security app is the ‘Brunhilda’ malware dropper. Upon installation, the app decrypts and executes three Vultur-related payloads (two APKs and a DEX file) that obtain access to the Accessibility Services, initialize the remote control systems...