Android users should keep their eyes peeled for a new version of the Exobot Malware circulating online. It was first discovered in May 2018 and uses the “Trump Edition” version of the malware that was released publicly a while ago. The leak of the code is expected to lead to a rapid increase in malicious Android apps in the near future.
The Trojan takes the name of the application it targets without asking for user permissions. There are a few bugs in the code, but most of the time the process runs normally.
It’s no secret that banking websites and apps are under constant attack, and many of these times, they are attacked via Trojans. With the new “Trump Edition,” however, there are two issues. First, when an infected device visits a banking website or app, the Trojan can steal the user’s information. Second, the malware is being spread at a high rate and successfully between uninfected devices.
The increase in these types of attacks won't just affect banks. "The type of data this malware is targeting will definitely affect other types of e-commerce companies as well," says Ryan Wilk, a researcher at NuData Security.
Data that identifies victimized users will soon start being sold on the dark web, where it could be used against victims, researchers believe.
Finally, we expect that the leak of Exobot's source code will increase overlay attacks, which Exobot is capable of. "When the malware is executed on the victim's device, it displays a window on top of the original application, which imitates the underlying application (e.g. an e-banking app) and thus deceives the user, stealing their details."
