Alien Malware Infects More than 226 Mobile Apps and Steals Bank Data

  • By Dawna M. Roberts
  • Sep 30, 2020

As reported on September 24, 2020, by ZDNet and ThreatPost, a new strain of malware named “Alien” is running rampant on the Android platform that has the power to steal passwords from more than 226 mobile apps!

The Dirty Details of Alien

Alien’s lineage comes from the infamous Cerberus banking trojan targeting victims’ banking data and personal information for identity theft. Most notably, a few of the apps on the list are Bank of America Mobile Banking and Capital One Mobile, along with social media and collaboration apps like Telegram, Snapchat, and Microsoft Outlook. 

As Cerberus slowly dies out, hackers are turning to Alien to fill the void. Rumor has it that Google discovered a way to detect and clean infected devices, which led to the demise of Cerberus. Alien is based on Cerberus code but enhanced with some extra features making it very dangerous. 

As early as January of this year, Alien was offered on the dark web as a Malware-as-a-Service (MaaS) and has been used by hackers worldwide to target banking institutions in various countries, including France, Germany, Italy, and the United States. 

According to cybersecurity experts, this variant of Cerberus has the ability to harvest and control SMS messages, access contact lists, keylogging functions, collect location data (GPS), forward calls, open web browsers, and employ overlay attacks (meaning phish login credentials by overlaying real login screens with fake ones). 

Most alarmingly, Alien is sophisticated enough to sniff notifications of infected apps, thwart two-factor authentication (2FA), and steal passwords. Alien does this by exploiting the “android.permission.BIND_NOTIFICATION_LISTENER_SERVICE” to control the user’s device’s notifications. In conjunction with this vulnerability, Alien uses the collaboration app TeamViewer to take complete control of the mobile device to change settings, install or uninstall apps, open apps, view information, and use the phone as if it was their own. Using TeamViewer, cybercriminals can also lock the screen like ransomware and demand money to unlock it. Alien is a mobile device user’s nightmare. 

Why You Should Be Concerned 

Alien is extremely dangerous because it targets user data, financial accounts, and other functions designed to allow fraudsters to steal money. Along with targeting banking apps, the malware also intercepts email and allows complete access to social media, instant messaging, and cryptocurrency apps like WhatsApp, Snapchat, Twitter, Telegram, Facebook, and Gmail. 

How You Can Avoid an Alien Infection

Although it’s not clear how mobile devices are infected with Alien, the evidence traces back to phishing emails, websites, and fake social ads. Some users have been infected through SMS when a friend or family member’s contact list has been stolen and used to phish more victims. Unfortunately, this most recent threat is aimed at non-technical phone users and those who don’t know what dangers to avoid. 

Google’s Play Store is diligent about cleaning and disinfecting apps before they are made available. However, that doesn’t mean that a few malicious apps don’t make it in. Some common-sense tips to avoid being affected by this potentially devastating strain of malware and opening yourself up to identity theft or worse, are:

  • Don’t install apps from anywhere except the Google Play Store. 
  • If an app asks for permission to an admin user or Accessibility service, deny it.
  • Don’t install any software on your phone that you do not trust and don’t just click through the prompts.
  • Update your phone’s security patches whenever they are available.
  • Install and run anti-malware software frequently.
  • Never click links in an email.
  • Do not click a link or respond to strange SMS messages even if they look like they come from someone you know.
  • Stay away from suspicious websites.
  • Never provide login credentials or other personal information online to anyone you don’t know. 
  • Do not respond to unsolicited emails, texts, or ads about COVID-related products or apps.

Security threats keep coming, and you have to be diligent and proactive every day to stay safe. 

About the Author
IDStrong Logo

Related Articles

46,000 Veterans and 13 Community Care Providers Affected by a VA Data Breach

The Incident Early last week, the Department of Veteran Affairs (VA) was breached by an unk ... Read More

Instagram Vulnerability Allowed Hackers Access to Control Your Phone

Security experts Check Point Research discovered a critical vulnerability while examining Instagra ... Read More

Universal Health Systems Hit by Ransomware Attack

Universal Health Systems (UHS), a Fortune 500 company owning more than 400 hospitals across the co ... Read More

Exchange Server Bug Exposes a Big Risk to Hackers

Months after Microsoft released a patch to fix a serious flaw in MS Exchange Server, more than 61% ... Read More

Clients’ Bank Data Exposed in Blackbaud Ransomware Attack

Blackbaud software was victim to a ransomware attack last May, and new information suggests that c ... Read More

Latest Articles

What is PPP Loan Fraud?

What is PPP Loan Fraud?

When the pandemic hit in 2020, our world became chaotic overnight. Throughout the nation, individuals were met with layoffs or stringent checks—pushing the financials of families to their breaking points.

Cementitious Vendor—CGM—Network Compromised by 315k Data Breach

Cementitious Vendor—CGM—Network Compromised by 315k Data Breach

Based in Philadelphia, Pennsylvania, CGM is a nationwide cementitious vendor for industries and construction projects. They are a leader in manufacturing, labeling, and distributing custom cement and patching products.

Chattanooga Heart Institute Updates on 2023 Network Cyber Attack

Chattanooga Heart Institute Updates on 2023 Network Cyber Attack

Patients with cardiovascular issues may appear in one of the Chattanooga Heart Institute (CHI) facilities in Tennessee and Georgia.

Featured Articles

How to Buy a House with Bad Credit

How to Buy a House with Bad Credit

Buying your own home is the American Dream, but it might seem out of reach to those with bad credit. However, the good news is, if your credit is less than perfect, you do still have options and in most cases, can still buy a home.

How Secure Is Your Password? Tips to Improve Your Password Security

How Secure Is Your Password? Tips to Improve Your Password Security

Any good IT article on computers and network security will address the importance of strong, secure passwords. However, the challenge of good passwords is that most people have a hard time remembering them, so they use simple or obvious ones that pose a security risk.

Top 10 Senior Scams and How to Prevent Them

Top 10 Senior Scams and How to Prevent Them

Senior scams are becoming a major epidemic for two reasons. First, seniors often have a lot of money in the bank from a life of working hard and saving.

Free Identity Exposure Scan
Instantly and Securely Check if Your Personal Information is Exposed on the Dark Web or Sold by Data Brokers
Please enter first name
Please enter last name
Please select a state
Close
Free Identity Threat Scan
Instantly Check if Your Personal Information is Exposed
All fields below are required
Please enter first name
Please enter last name
Please enter a city
Please select a state
Please enter an age
Please enter an email address
Close