Ankura CTIX FLASH Update - December 1, 2023

Ransomware/Malware Activity

Malicious Android Apps Used to Target Iranian Banks

An ongoing Android malware campaign targeting users of Iranian financial institutions has expanded to include new abilities to target an even greater number of people and prevent detection on compromised devices. The campaign consists of fake Android applications imitating the legitimate version of apps used by financial institutions. While originally only forty (40) Android apps had been discovered by researchers, a new report from Zimperium now states that more than 200 apps are connected to the malware campaign. These applications trick the device user into allowing escalated privileges before the malware abuses Android's accessibility services to harvest financial information, including bank account details, passwords, and credit card numbers. The latest findings suggest that these apps can also intercept SMS messages as well as prevent the uninstallation of the application so it