Share on LinkedInShare on LinkedIn

ARTICLE · 02 JULY 2024

Ankura CTIX FLASH Update - June 28, 2024

A banking trojan known as "Medusa" or "TangleBot" has been recently observed targeting seven (7) countries including the United States.

United StatesTechnology

Ransomware/Malware Activity

The "Medusa" Android Banking Trojan is Back

A banking trojan known as "Medusa" or "TangleBot" has been recently observed targeting seven (7) countries including the United States. Medusa was first discovered in 2020, and its versions have increased in sophistication over time. The latest version seen in campaigns operating since May 2024 now requests fewer permissions from the victim device, can initiate transactions directly from the device, retains keylogging and SMS manipulation capabilities, and includes commands for screenshot capturing. The malware's primary purpose is to perform overlay attacks to steal victims' banking credentials. Overlay attacks occur when malware overlays its own window on top of another program to hijack credentials. Researchers at online fraud management company Cleafy observed 24 recent campaigns that have been attributed to five (5) botnets delivering the Medusa payload mainly via SMS phishing,

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

See more popular content from