Massiv Android Banking Trojan Uses IPTV Lures for Device Takeover and Fraud
Summary
Threat Fabric details Massiv, an Android banking Trojan distributed through IPTV-themed apps. It steals credentials and controls devices remotely, enabling fraudulent transactions; campaigns have been observed in southern Europe.
Key points
- Massiv uses overlays, keylogging, and SMS or push-message interception to steal credentials and sensitive data.
- Its remote-control capability uses Android AccessibilityService and a WebSocket command channel, with screen streaming and UI-tree modes.
- Researchers identified fraudulent cases in southern Europe, including accounts opened in victims’ names at banks and services they did not use.
- One campaign targeted Portugal’s gov.pt digital identity app, potentially seeking details that could help bypass KYC checks.
- Dropper apps masquerade as IPTV services, while the actual malware may already be installed and running; observed targeting included Spain, Portugal, France, and Turkey.
- The researchers report ongoing development and API keys in malware communications, but say Massiv has not yet been observed as a Malware-as-a-Service offering.
Article Details
- Attack Vectors
- Massiv was distributed through an IPTV-app lure, masquerading as an IPTV application and using sideloading outside official app stores.
- Massiv displays fake overlays when targeted applications are opened to steal credentials and other sensitive information, and uses keylogging and SMS/Push message interception.
- The malware remotely controls infected Android devices through AccessibilityService-based UI interaction, using screen streaming or UI-tree data over a WebSocket command-and-control channel.
- A campaign targeted Portugal's gov.pt application, seeking victims' phone numbers and PIN codes.
- Defensive Notes
- Financial organizations are advised to monitor Massiv and its potential growth into a Malware-as-a-Service offering.
- The article describes sideloading from unofficial sources as part of the IPTV-app lure; users should be cautious about installing applications from unknown sources.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 54d4cb45fb7a18780ff2ccc7314b9b51ae446c58a179abbf9e62ce0c28539e8e | SHA-256 hash identified as the Massiv payload. |
| SHA256 | f9a52a923989353deb55136830070554db40f544be5a43534273126060f8c1f6 | SHA-256 hash identified as the IPTV24 dropper. |
MITRE ATT&CK
T1412Massiv intercepts SMS and push messages.T1417.001Massiv uses keylogging to obtain sensitive data from infected devices.T1422Massiv obtains information about visible UI elements through Accessibility services and UI-tree traversal.T1433Massiv uses a WebSocket channel for command-and-control communications.T1476The dropper masquerades as an IPTV application to persuade victims to install it.T1513Massiv streams screen content to the remote operator using Android MediaProjection.T1516The remote operator can manipulate the device UI through AccessibilityService-based interaction.T1517Massiv monitors launched applications and displays fake overlays to collect credentials and other sensitive information.
Malware
Products
AndroidA modern Android banking Trojan, which is usually distributed through side-loading, must convincingly masquerade as a legitimate application so that it does not raise suspicion and persuades victims to proceed with theChave Móvel DigitalIt also connects with another service, Chave Móvel Digital, a Portuguese digital authentication and signature system that allows citizens to securely access public and private online services.gov.ptInterestingly, one of the campaigns of Massiv, analyzed by our analysts, targeted Portuguese government application gov.pt, asking the victim for phone number and PIN code.
Countries
FranceCountries that were observed targeting by such masquerading include Spain, Portugal, France, Turkey.PortugalThis application serves as a digital identity wallet for Portugal.SpainCountries that were observed targeting by such masquerading include Spain, Portugal, France, Turkey.TurkeyCountries that were observed targeting by such masquerading include Spain, Portugal, France, Turkey.