A survey of apps used for mobile bankingrevealed that more than 11% of them should be considered at least suspicious, since many of them contain malware and adware.
According to a study by RiskIQ, the top 90 app stores worldwide host approximately 350,000 apps for banking transactions. Of these, over 40,000 contain dangerous scripts in their code.
RiskIQ is a company that relies on a massive crawling system to collect information in real time from the web, helping its customers maintain their security on the web and on their mobile devices.
With mobile banking apps becoming a common activity worldwide, cybercriminals have also adapted to the new reality. “One of the easiest ways to steal a victim’s connection and other personal information is to use malicious software and apps with excessively many permissions,”, says the CEO of the company, Elias Manousos.
According to the findings, of more than 40,000 mobile banking apps inspected by automated systems, 21,076 contained some adware, while 20,000 had Trojans.
Spyware were also detected in 3,823 Android applications that were intended for online banking transactions. Only a small percentage of these contained malicious JavaScript.
As expected, most of the apps presented an excessive list of permissions to the user, which most of the time they would agree to without even reading them and seeing what is being requested.
It appears that most mobile banking apps had the ability to capture device logs and even record audio. Another requirement was access to the contacts list, as well as reading SMS messages, very useful for extracting the two‑factor authentication (2FA) code.
