Click to Skip Ad
Closing in...

New Android malware steals banking information, and spreads through Google’s own network

Updated Aug 16th, 2016 11:29AM EDT
Android Malware
Image: Shutterstock

If you buy through a BGR link, we may earn an affiliate commission, helping support our expert product labs.

Earlier today, researchers from Kaspersky Lab reported that they recently stumbled across a new piece of sophisticated Android malware designed to steal a user’s banking credentials. In a broad sense, the malware is similar to other schemes we’ve seen before insofar that it uses cleverly thought out phishing schemes designed to trick users into entering in their banking user ID and password.

DON’T MISS: New photos and video show iPhone 7 Plus in the color we’ve all been waiting for: Space Black

All the more worrisome is that the malware is able to intercept, delete and even send text messages sent from banking institutions. The danger with this is two-fold. One, some banks will send users an alert or notification when suspicious banking activity is detected. If the malware can delete such messages, users remain oblivious to the fact that their account may have been compromised.

Two, some banks have security protocols that require users to authenticate certain transactions or otherwise unusual banking activity via SMS. What’s more, the report notes that “the malware can counteract mobile security solutions that are popular in Russia by completing their processes.”

Now if that weren’t bad enough, Kaspersky adds that the malware is being spread by Google’s own AdSense advertising network.

This morning, we encountered a gratuitous act of violence against Android users. By simply viewing their favorite news sites over their morning coffee users can end up downloading last-browser-update.apk, a banking Trojan detected by Kaspersky Lab solutions as Trojan-Banker.AndroidOS.Svpeng.q. There you are, minding your own business, reading the news and BOOM! – no additional clicks or following links required. And be careful – it’s still out there!

It turns out the malicious program is downloaded via the Google AdSense advertising network. Be warned, lots of sites use this network – not just news sites – to display targeted advertising to users… The Trojan is downloaded as soon as a page with the advert is visited.

Notably, Kaspersky adds that the malware, for now, only appears to be targeting users in Russia. Google has yet to issue a comment on the matter and we’ll update this post if and when they do.

Update: The issue has been quickly resolved and Google tells us that there is no indication that the problem affected more than one website.

Yoni Heisler Contributing Writer

Yoni Heisler has been writing about Apple and the tech industry at large with over 15 years of experience. A life long expert Mac user and Apple expert, his writing has appeared in Edible Apple, Network World, MacLife, Macworld UK, and TUAW.

When not analyzing the latest happenings with Apple, Yoni enjoys catching Improv shows in Chicago, playing soccer, and cultivating new TV show addictions.