Ankura CTIX FLASH Update - August 2, 2024

Malware Activity

BingoMod Banking Trojan Initiates Fraudulent Transactions on Infected Devices

BingoMod is a newly discovered and actively developed Android remote access trojan (RAT) that targets users through SMS phishing, posing as legitimate security tools like antivirus apps or Chrome updates. Attributed to a likely Romanian-speaking threat actor, BingoMod is capable of performing on-device fraud (ODF) by taking over accounts and initiating fraudulent money transfers of up to €15,000 per transaction directly from compromised devices. It requests permissions for Accessibility Services, allowing it to steal sensitive information such as login credentials and bank account details, intercept SMS messages, and take screenshots. The malware establishes a socket-based channel for remote commands and an HTTP-based channel for transmitting real-time screen content to the attackers. Notably, BingoMod employs advanced evasion techniques, including code obfuscation, the