Two antiviruses for Android hide a great threat

Two antiviruses for Android hide a great threat

If you have installed an antivirus for your mobile thinking that it will be safer this way, this information may surprise you, but a Trojan has been detected that affects two fake antivirus apps that you may have downloaded from the Google Play Store. These, instead of protecting you, can end up stealing your bank details after you install them, so check if you have them and uninstall them immediately.

The SharkBot Trojan attacks Android users again, although now, curiously, it does so through fake antivirus applications that users installed thinking that it would protect their device, and they do the opposite! Find out what they are and get rid of them as soon as possible if you have installed them.

What is this Trojan

In April this year, security researchers found the SharkBotDropper Trojan in several antivirus apps on the Google Play Store, including Antivirus, Super Cleaner.

apps malware

However, a new report from Fox-IT suggests that there are 2 new antivirus apps for Android that are infected with the SharkBot Trojan and we will talk about them below, but not before telling you how they work.

The way this virus attacks the device is new and does not require device accessibility permissions. In addition, it is selective with its victims, so that it does not redirect all its potential victims that it can find, but selects them carefully.

It is able to identify users from China, India, Romania, Russia, Ukraine or Belarus to ignore them and not attack them. Yes, it would do so with users who use some of its applications in other countries.

To discover online banking credentials , it uses several approaches. First, it might launch a fake login page when the banking app is opened, very similar to the original but controlled by cybercriminals. You can also record keystrokes and send them to an external server. It can also reply to the text message and spread via shareable links within the texts. It can also create a path for hackers to sneak onto the device and automatically fill out transaction forms in your bank’s app.

Which apps are infected

If you are wondering which are the new ‘antiviruses’ that contain malware, the applications in particular are Mister Phone Cleaner and Kylhavy Mobile Security. According to the report, Mister Phone Cleaner has 50,000 downloads and Kylhavy Mobile Security has more than 10,000 downloads, figures that are not negligible. Both hide malware designed to steal online banking credentials the moment they are installed.

antivirus-infectados-play-store

Therefore, if you just realized it now and you have installed any of these apps, Mister Phone Cleaner and Kylhavy Mobile Security, as well as any of the previous fake antiviruses, you should uninstall them as soon as possible. Also, stop using your bank’s app until this threat is completely gone to make sure they don’t take advantage of the opportunity to steal your money or harm you financially.

We also recommend that you download a good reliable antivirus that has a reputation and pass it to see if you find any threat on your computer, especially if you notice that there is a bank transaction that you have not done, you realize that your mobile has gone crazy or you appreciate something strange in him.