The Godfather Android banking Trojan has a deal that you better refuse. A Trojan is a malicious app that pretends to be legitimate. It might actually perform the tasks that led you to install it in the first place until it receives its orders from a Command & Control (C&C) server. A banking Trojan goes after the information and data you use to sign into your banking apps and with that info in hand, it gets into your bank accounts and causes major headaches for you.
The Godfather banking Trojan has targeted more than 400 banking and crypto apps in 16 countries
Fake Turkish banking app waiting to collect a victim’s login information
When an Android user interacts with a phony notification or tries to open a legitimate app targeted by the Trojan, a fake overlay appears on the screen collecting usernames and passwords typed by the victim on his phone. The victim is tricked by the overlay into thinking that this information is required to open the infected banking or financial services app. Godfather can also bypass two-factor authorization making it extremely dangerous.
Interestingly, Godfather seems to back down from infecting phones that list a language spoken in a post-Soviet country as a preference. Those countries include Russia, Azerbaijan, Armenia, Belarus, Kazakhstan, Kyrgyzstan, Moldova, Uzbekistan, and Tajikistan. That leads Group-IB to believe that the developers of the Trojan speak Russian. The Trojan has also been known to record the victim’s screen, send fake text messages from an infected device, and more.
Here are the steps to take to protect your Android phone from a banking Trojan
So with the user duped into thinking that the app has been scanned and no malware discovered, he opens his banking app, uses his login, and has just given the bad guys the key to his vault. But you can take certain steps that could help you fight back against banking Trojans like Godfather.
Malicious app once listed in the Google Play Store
According to Group-IB, always make sure that you are running the latest version of Android on your phone. The more recent the version of Android running on your phone, the less likely it is to be infected by a banking Trojan.
What can you do if your phone is already infected? Group-IB says to take the following three steps:
- Disable network access.
- Freeze any bank accounts that may have been accessed from your device.
- Contact experts to receive detailed information about the risks that the malware could pose to your device.
