Banking Malware on YouTube Vanced, delete it immediately!

A new Android banking trojan called Nexus was discovered by Cyble Research and Intelligence Labs (CRIL) and cybersecurity firm Cleafy (through Tom's Guide).

It first appeared last June and is now being openly advertised by its creators on hacker forums to increase its reach. Nexus' primary targets are 450 banking and cryptocurrency apps.

Διανέμεται μέσω ιστοσελίδων phishing που παριστάνουν τις νόμιμες ιστοσελίδες του YouTube Vanced, μιας καταργημένης εφαρμογής YouTube τρίτου μέρους. Χρησιμοποιεί όλα τα γνωστά κόλπα για να αποκτήσει τις τραπεζικές σας πληροφορίες και να καταλάβει τους οικονομικούς σας λογαριασμούς.

yv

 

Nexus asks for 50 permissions and abuses at least 14 of them!

It is capable of performing cloaking attacks, i.e. copying a legitimate interface to trick you into entering your credentials, and uses keylogging to record your keystrokes. It can even intercept SMS messages to gain access to two-factor authentication codes, and it can abuse Accessibility Services to intercept information from crypto wallets, 2-step verification codes generated by Google Authenticator, and website cookies. The trojan can also delete received messages.

Once installed on a device, Nexus connects to the command and control server (C2). C2s are used by cybercriminals to control malware, launch attacks, and receive stolen data.

Nexus is said to be in beta stage, but it is already being used by many threat actors to carry out malicious activities. Cybercriminals who don't know how to make their own malware can rent it for $3.000 a month.

The developer appears to be from a Commonwealth of Independent States (CIS) country and has banned the use of the trojan in Azerbaijan, Armenia, Belarus, Kazakhstan, Kyrgyzstan, Moldova, Russian Federation, Tajikistan, Uzbekistan, Ukraine and Indonesia.

Nexus is capable of updating itself and Cleafy believes it is a real threat and can infect hundreds of Android devices in the world.

To protect yourself from infections, try to only download apps from Google Play and enable Google Play Protect. Use strong passwords and enable biometric security features where possible and be very careful when granting permissions.

 

iGuRu.gr The Best Technology Site in Greece
Follow us on Google News

YouTube Advanced

Written by Anastasis Vasileiadis

Translations are like women. When they are beautiful they are not faithful and when they are faithful they are not beautiful.

2 Comments

Leave a Reply
  1. Are you referring to Vanced or what you write also applies to Revanced extended? I ask because I use the second one and you worried me.

Leave a reply

Your email address is not published. Required fields are mentioned with *

Your message will not be published if:
1. Contains insulting, defamatory, racist, offensive or inappropriate comments.
2. Causes harm to minors.
3. It interferes with the privacy and individual and social rights of other users.
4. Advertises products or services or websites.
5. Contains personal information (address, phone, etc.).