BeatBanker Android Trojan Targets Brazilian Users With Fake Government and Starlink Apps
Summary
Researchers say BeatBanker spreads through fake Starlink and Brazilian government apps, stealing banking credentials, hijacking USDT transfers and mining Monero. A variant delivers the BTMOB remote-access trojan.
Key points
- Fake apps mimicking Starlink and Brazil’s INSS Reembolso portal were distributed through a website masquerading as the Google Play Store.
- BeatBanker steals banking credentials and overlays Binance or Trust Wallet USDT transfers to replace the intended destination with an attacker-controlled wallet.
- The trojan mines Monero and monitors battery temperature, battery level and user activity to time mining.
- BeatBanker maintains persistence by continuously playing a nearly inaudible audio file, which researchers say can prevent Android from terminating the app for inactivity.
- A campaign variant delivers BTMOB, a remote-access trojan that gives attackers access to a victim’s camera, keystrokes, GPS location and other data.
- Researchers observed infections in Brazil; some BTMOB-distributing samples appeared to spread through WhatsApp messages and phishing pages.
Article Details
- Attack Vectors
- BeatBanker was distributed through fake Android apps impersonating Starlink and the INSS Reembolso portal, hosted on a website masquerading as the Google Play Store.
- Some BTMOB-distributing samples appeared to spread through WhatsApp messages and phishing pages.
- BeatBanker overlays cryptocurrency transaction screens and replaces the intended USDT destination address with an attacker-controlled wallet address.
- A campaign variant delivered BTMOB, which provided remote access to victims’ phones.
MITRE ATT&CK
T1417.001BTMOB could access keystrokes on infected phones.T1430BTMOB could access victims’ GPS location.T1476BeatBanker was delivered in fake Android applications through a website masquerading as the Google Play Store.T1496.001 · Compute HijackingBeatBanker secretly mined Monero on infected phones, using their processing power.T1512BTMOB could access the camera on infected phones.
Malware
BeatBankerResearchers discovered BeatBanker, a new Android trojan campaign in Brazil that infects phones via fake apps mimicking Starlink and the INSS Reembolso portal to steal banking credentials and manipulate cryptocurrencyBTMOBmonitoring plus a nearly inaudible audio loop to maintain persistence, and some variants deliver the BTMOB remote-access trojan to give attackers full control.
Products
AndroidResearchers discovered BeatBanker, a new Android trojan campaign in Brazil that infects phones via fake apps mimicking Starlink and the INSS Reembolso portal to steal banking credentials and manipulate cryptocurrencyBinanceThe malware steals banking credentials and overlays transaction screens to redirect USDT transfers on apps like Binance and Trust Wallet.INSS Reembolsoa new Android trojan campaign in Brazil that infects phones via fake apps mimicking Starlink and the INSS Reembolso portal to steal banking credentials and manipulate cryptocurrency transactions.StarlinkBeatBanker, a new Android trojan campaign in Brazil that infects phones via fake apps mimicking Starlink and the INSS Reembolso portal to steal banking credentials and manipulate cryptocurrency transactions.Trust WalletThe malware steals banking credentials and overlays transaction screens to redirect USDT transfers on apps like Binance and Trust Wallet.WhatsAppA campaign variant delivers the BTMOB remote-access trojan for full device control, with infections observed in Brazil and distribution via WhatsApp messages and phishing pages.