cyber.hendryadrian.com
Security News · bleepingcomputer.com

Massiv Android Banking Malware Disguises Itself as an IPTV App

· Original article ↗

Summary

ThreatFabric researchers report that Massiv, an Android banking malware disguised as an IPTV app, targeted a Portuguese government app linked to Chave Móvel Digital. It uses overlays, keylogging and remote-control features to steal data and access accounts.

Key points

  • Massiv is distributed through fake IPTV apps, often packaged as droppers users sideload from unofficial channels.
  • ThreatFabric observed Massiv targeting a Portuguese government app connected to Chave Móvel Digital.
  • The malware uses screen overlays and keylogging to capture sensitive information.
  • Operators can stream a device screen using Android’s MediaProjection API or control interfaces through Accessibility UI-tree data.
  • ThreatFabric says infected users’ identities have been used to open accounts controlled by fraudsters, potentially enabling money laundering and loans in victims’ names.
  • ThreatFabric reports that fake IPTV malware droppers have primarily targeted users in Spain, Portugal, France and Turkey; it describes IPTV lures as increasing over the past eight months.
  • The article recommends installing vetted apps from official channels, keeping Play Protect active and scanning devices regularly.

Article Details

Event Type
Discovery and reporting of Massiv, a new Android banking malware campaign disguised as an IPTV app.
Impact
Massiv uses screen overlays, keylogging, screen streaming, and Accessibility-based device control to steal sensitive information and access online banking accounts. ThreatFabric reported that the malware targeted a Portuguese government app connected to Chave Móvel Digital, creating risks of identity theft, KYC bypass, account takeover, and fraudulent accounts that could be used for money laundering.

Malware

MassivResearchers discovered a new Android banking malware named Massiv that disguises itself as an IPTV app to steal digital identities and access online banking accounts.

Countries

FranceThe researchers report that fake IPTV-masking malware droppers have primarily targeted users in Spain, Portugal, France, and Turkey.PortugalThreatFabric, Massiv targeted a Portuguese government app that connects with Chave Móvel Digital – Portugal’s digital authentication and signature system.SpainThe researchers report that fake IPTV-masking malware droppers have primarily targeted users in Spain, Portugal, France, and Turkey.TurkeyThe researchers report that fake IPTV-masking malware droppers have primarily targeted users in Spain, Portugal, France, and Turkey.

Industries

BankingResearchers discovered a new Android banking malware named Massiv that disguises itself as an IPTV app to steal digital identities and access online banking accounts.GovernmentIn a campaign observed by ThreatFabric, Massiv targeted a Portuguese government app integrated with Chave Móvel Digital and uses screen overlays, keylogging, MediaProjection and Accessibility-based UI-tree control to