Ankura CTIX FLASH Update - November 1, 2024

Ransomware/Malware Activity

FakeCall Android Malware Routes Bank Calls to Attackers

Cybersecurity researchers are tracking a new variant of an Android malware dubbed "FakeCall". The malware is designed to intercept phone calls made to the victim's bank and route the call to an attacker-owned phone number. Built for Android and deployed via an APK (Android Package Kit), the malware reroutes calls by setting itself up as the default call handler during installation. FakeCall displays a convincing UI that mimics Android's call interface, displaying the bank's legitimate phone number while the victim is actually on a call with the attacker. FakeCall is delivered via social engineering attacks, and the attacker's goal is to obtain sensitive banking information from the victim. The FakeCall trojan was first seen in 2022 and is now impersonating over twenty (20) financial organizations. In addition to hijacking calls, the latest versions of FakeCall include a new phone