The malware can grab users’ credentials, SMS messages, and current account balances. After funds are transferred out of the phone, the infected device is completely wiped eliminating all traces of BingoMod from the phone. How does BingoMod end up on an Android handset? The process starts when a device owner is tricked into installing an app that pretends to be (quite ironically) anti-virus software. The app, as previously noted, asks for permission to access Accessibility Services. If the app gets this green light, it releases its payload which is aimed at the user’s financial accounts.
However, this functionality is limited to the device’s external storage only, so we speculate that the complete wipe is performed by [threat actors] directly from the device’s system settings, leveraging BingoMod’s remote access capabilities.”-Cleafy Labs
The attack targets devices running three languages: English, Italian, and Romanian. Once installed and has access to Accessibility Services, the malware runs in the background and intercepts SMS messages, and tracks the keys pressed on the phone’s virtual keyboard. With this stolen data, the attackers can figure out the credentials needed to log in to victim’s financial accounts via banking, securities, and credit card apps installed on the targeted handset.
To protect itself, BingoMod makes it hard to edit system settings on the targeted device. It also will prevent certain apps from running certain features, and will even uninstall other apps to help it escape detection.
Cleafy says that BingoMod isn’t as sophisticated as other Android trojans such as banking malware SharkBot. But the “fraud hunters” worry that the attack “poses significant risks to end-users and financial institutions due to the potential for substantial economic loss and the disruption of personal data security.”
Maybe life won’t be as much fun for you if you don’t sideload apps on your Android phone, but you might save yourself the worry and concern about having your financial accounts accessed by online thieves. In addition, even if you limit your app browsing to the Google Play Store, you should download apps only from developers that you are familiar with.
