ESET experts have detected the first cases of a new wave of attacks on banks in the Czech Republic and Slovakia via mobile banking. At the same time, cyber attackers used malware for the platform Android, which was already spreading in the Czech Republic at the end of January, but the target was financial houses in Germany. However, the malicious code is now localized and poses a threat to home users.
"A new wave of malware is targeting the Czech Republic, which is spreading via fraudulent SMS messages. According to current information, the attackers have focused only on ČSOB for the time being. However, it can be expected that the range of target banks will soon expand," states Lukáš Štefanko, a malware analyst at ESET.
Malicious trojan code for the platform Android is a new variant of the already known malware family that was in the conclusion January spread through fake SMS messages pretending to be communications from the Czech Post or the Alza.cz store.
Malware that ESET detects under the name Android\Trojan.Spy.Banker.HV sends users a fake login page when they open Internet banking. An inattentive user thus unwittingly sends his login information to fraudsters and exposes himself to the threat of account theft.
In the current attack campaign, which is taking place in the Czech Republic and Slovakia, this dangerous malware is distributed via SMS with a link to a supposed DHL app, but it downloads a fraudulent app called "Flash Player 10 Update" with a DHL icon. Although the attackers have changed the name of the application, the icon has not yet been changed, which looks suspicious when installed in a Czech or Slovak environment.
"To limit the risks, I recommend following two basic safety measures in particular. First of all, it is necessary not to be tricked into installing applications by links that may lead to a fraudulent page. The application that the user wants to install must always be found in the official application store or on trusted websites," explains Lukáš Štefanko. Users of ESET security products are protected against this threat.
