Brazilian users and most likely more in the rest of the world are reporting malicious activity of what could be a Trojan for Android that pretends to be the Google Play Store. According to the cybersecurity firm Cyble, cybercriminals have created a fake Google Play Store page, which is being used to attack the millions of clients of Itau Unibanco bank with a malicious mobile banking application.
It is suspected that it is a massive phishing attack directed at Brazilian users by making them download an app from the bank that claims to be legitimate. Once the victim is lured to the fake page that looks almost identical to the legitimate Play Store, clicking the download button prompts for an APK download instead of installing it directly.
Phishing attack pretending to download the bank's app
The fact that you ask to install an APK is the first major warning sign. The Google Play Store installs the applications through the store interface and never offers the user the possibility to download the actual APK.
If the fake application is downloaded and run, it will try to open the real Itau Unibanco application from the legitimate store, and use it to empty the victim's accounts. The application does not even need additional permissions during installation, making it difficult for antivirus and antimalware tools to detect it. This is because the rogue app uses the Accessibility Service, which gives the Trojan everything it needs to bypass Android security protections.
The malicious application will ask for permissions to perform gestures, retrieve the contents of the windows and observe the actions of the user, which is more than enough to steal the access information. The fake website has been taken down, but a new one may have appeared in the meantime. Despite the fact that this is a Trojan aimed at Brazilians, it is very likely that it is used to simulate the Google Play Store when downloading other banking applications.
Source: TechRadar
