Trojan developer Faketoken is exploiting ride - hailing and ride - tracking apps to steal the functionality of some Russian software , Moscow - based cybersecurity developer Kaspersky Lab has said . The software overlays a phishing window on certain live apps and then records a user 's keystrokes . The modification steals incoming SMS messages , such as one - time verification passwords sent by a user , by redirecting them to its command and control servers . Kaspersky 's apps have also found Faketoken attacks on travel and hotel booking apps , Android Pay and Google Play Market .
Trojan virus Faketoken is exploiting ride-hailing and ride-sharing apps to steal the credentials of some Russian users, Moscow-based cybersecurity firm Kaspersky Lab has said. The trojan overlays a phishing window on certain live apps and then records a user's keystrokes. The modification steals incoming SMS messages, such as one-time verification passwords sent by a bank, by redirecting them to its command and control servers. Kaspersky's researchers have also found Faketoken attacks on travel and hotel booking apps, Android Pay and Google Play Market.