Security researchers have discovered a new Android banking trojan they named Brokewell that can capture every event on the device
The malware is delivered through a fake Google Chrome update that is shown while using the web browser
Researchers at fraud risk company ThreatFabric found Brokewell after investigating a fake Chrome update page that dropped a payload, a common method for tricking unsuspecting users into installing malware.
https://www.threatfabric.com/blogs/brokewell-do-not-go-broke-by-new-banking-malware
Interestingly, this loader can bypass the restrictions Google introduced in Android 13 and later to prevent abuse of Accessibility Service for side-loaded apps (APKs).
As highlighted with Brokewell, loaders that bypass restrictions to prevent granting Accessibility Service access to APKs downloaded from shady sources have now become common and widely deployed in the wild.
Advice >> ensure that Play Protect is active on your device at all times.....
@ecksmc 👍🏿
Online banking on a Android phone. There's a sucker born every day.
@Dane lol yeah if you instal dodgy apps/software or dodgy updates that's not via play store
iPhone ain't any different when it comes to risk GoldPickaxe trojan or GoldDigger trojan to name two that affect iOS users
The researchers discovered another tool called "Brokewell Android Loader," also developed by Samedit. The tool was hosted on one of the servers acting as command and control server for Brokewell and it is used by multiple cybercriminals.
Tools sold on the threat actor's website
-- ThreatFabric