Getty Security researchers found an Android Trojan acting as a performance-boosting app to try steal from people’s PayPal accounts. ESET discovered it in third-party app stores. The malware generates a fake Android security option through which users inadvertently give it access. Researchers at the University of California, Santa Barbara (UCSB) and Microsoft (MSFT) have published research that shows how they were able to use Android’s sandboxing mechanism to bypass Google’s own The malware uses that information to transfer money out of an account, bypassing even two-factor authentication. It fails if the user has a low balance or no funding source. The malware also has a phishing feature imitating legitimate apps to get payment information.
Security researchers found an Android Trojan acting as a performance-boosting app to try steal from people’s PayPal accounts. ESET discovered it in third-party app stores. The malware generates a fake Android security option through which users inadvertently give it access. Researchers at the University of California, Santa Barbara (UCSB) and Microsoft (MSFT) have published research that shows how they were able to use Android’s sandboxing mechanism to bypass Google’s own The malware uses that information to transfer money out of an account, bypassing even two-factor authentication. It fails if the user has a low balance or no funding source. The malware also has a phishing feature imitating legitimate apps to get payment information.