‘BlackRock’ can steal credentials and credit card info from over 300 plus apps like email of clients, e-commerce apps, virtual currency, messaging or social media apps, entertainment apps, banking and financial apps etc, says CERT-In advisory
THE country’s cyber security agency has issued an alert against an Android malware, dubbed ‘BlackRock’, that has the potential to “steal” banking and other confidential data of a user. It can extract credentials and credit card information from over 300 apps such as email, e-commerce apps, social media apps, besides banking and financial apps, the Computer Emergency Response Team of India (CERT-In) said in an advisory. The “attack campaign” of this ‘Trojan’ category virus is active globally, said CERT-In, national technology arm to combat cyberattacks and guard Indian cyber space.
“It is reported that a new Android malware strain dubbed ‘BlackRock’ equipped with datastealing capabilities is attacking a wide range of Android applications. “The malware is developed using the source code of Xerxes banking malware which itself is a variant of LokiBot Android Trojan,” the advisory said. The “noteworthy feature” of this malware is that its target list contains 337 applications including banking and financial applications, and also non-financial and well-known commonly used brand name apps on an Android device that focus on social, communication, networking and dating platforms, it said.
“It can steal credentials and credit card information from over 300 plus apps like email clients, e-commerce apps, virtual currency, messaging or social media apps, entertainment apps, banking and financial apps etc,” the advisory said. The advisory described the infection activity of the virus. “When the malware is launched on the victim’s device, it hides its icon from app drawer and then masquerades itself as a fake Google update to request accessibility service privileges.”
“Once this privilege is granted, it becomes free to grant itself additional permissions allowing it to function further without interacting with user,” it said. Threat operators can issue a number of commands for various operations such as logging keystrokes, spamming the victims’ contact lists with text messages, setting the malware as the default SMS manager, pushing system notifications to the C2 (command and control) server, locking the victim in the device home screen and steal and hide notifications, send spam and steal SMS messages and many more such activities, the advisory said. The virus is deadly as it has the capability to “deflect” majority of anti-virus applications.