A new variant of the Android banking trojan named Xenomorph has surfaced in the wild, latest findings from ThreatFabric reveal. Named "Xenomorph 3rd generation" by the Hadoken Security Group, the threat actor behind the operation, the updated version comes with new features that allow it to perform financial fraud in a seamless manner."
This new version of the malware adds many new capabilities to an already feature-rich Android banker, most notably the introduction of a very extensive runtime engine powered by Accessibility services, which is used by actors to implement a complete ATS framework," the Dutch security firm said in a report shared with The Hacker News.Xenomorph first came to light a year ago in February 2022, when it was found to target 56 European banks through dropper apps published on the Google Play Store.
In contrast, the latest iteration of the banker – which has a dedicated website advertising its features – is designed to target more than 400 banking and financial institutions, including several cryptocurrency wallets.
ThreatFabric said it detected samples distributed via Discord's Content Delivery Network (CDN), a technique that has witnessed a surge since 2020. Two of the Xenomorph-laced apps are listed below - "Xenomorph v3 is deployed by a Zombinder app 'bound' to a legitimate currency converter, which downloads as an 'update' an application posing as Google Protect," ThreatFabric explained.The Xenomorph malware has been around for a while, but a new variant has surfaced that is even more dangerous.
This new version comes with new features that allow it to perform financial fraud in a seamless manner. This is a serious threat to anyone who uses Android devices for banking or other financial transactions.If you have any apps that perform financial transactions on your Android device, you should be on the lookout for this new variant of the Xenomorph malware. Keep an eye out for any suspicious activity on your device, and if you see anything, make sure to report it to your bank or financial institution immediately.