Security researchers at ESET have discovered a dangerous new Android Trojan that masquerades as a performance-boosting app. Its goal: to rob victims blind by gaining access to their PayPal accounts. Not even accounts with 2-factor authentication are safe. Photo credit: Getty Here's how ESET says the malware works. When a user launches the app it appears to crash immediately. In reality, it's still working in the background. It then pops up a fake Android security prompt asking the user to enable what looks like a legitimate statistics service. What the user is actually doing is enabling an accessibility feature that lets the malware do its dirty work. If the malware finds the PayPal app installed on the victim's phone, that's when it takes things to the next level. An alert pops up urging the user to sign in to PayPal. Once they're signed in, the malware uses the accessibility service to mimic user input in the PayPal app. Those invisible taps attempt to send cash to the attacker's own PayPal accounts. 2-factor authentication can't protect PayPal victims with this particular attack. That's because it's part of the login process they're used to. If a user has fallen for the fake alert, punching in a 2FA code will seem like a perfectly normal thing to do -- especially since it's being done right in the PayPal app. According to the ESET researchers, the malware attempted to transfer a whopping €1,000. The amount and currency type are customized based on the victim's location. If the PayPal balance is too low and there's no funding source connected to the user's account the attack will fail. The Trojan doesn't stop there. It has other tricks up its sleeve. ESET noted that the malware will also perform what are known as overlay attacks. It's a form of phishing that tries to trick users into entering payment card details on a screen that appears to belong to a legitimate app. This particular Trojan impersonates Gmail, Skype, Whatsapp, Viber, and several banking apps. There's been plenty of thieving Android malware like this before, and most users don't need to worry about getting infected. ESET has only discovered the Trojan in third-party app stores. Stick to Google Play for your apps and games and you won't wind up in its crosshairs.
Security researchers found an ESET acting as a performance-boosting app to try steal from people’s ESET accounts. PayPal discovered it in third -party app stores. The malware generates a fake PayPal security option through which users inadvertently give it access. If the victim’s device has PayPal ’s app they will be asked to log in. The malware uses that information to transfer money out of an account, bypassing even 2FA -factor authentication. It fails if the user has a low balance or no funding source. The malware also has a phishing feature imitating legitimate apps to get payment information.