Brokewell Android Malware Steals Banking Data and Enables Remote Device Control
Summary
ThreatFabric describes Brokewell, Android malware distributed through a fake browser update that steals credentials, cookies and device data, and enables remote control. Researchers link its developer to a publicly available loader bypassing Android 13+ restrictions.
Key points
- A fake browser-update page delivered Brokewell, which researchers also found had previously targeted a buy-now-pay-later service and an Austrian digital authentication app.
- The malware uses overlays to capture credentials and a WebView to collect session cookies after victims log in.
- Accessibility logging records device interactions, displayed information and text input; the malware can also collect device details, call history and location, and record audio.
- Remote-control commands let an operator stream the screen and perform actions such as taps, swipes and text input on an infected device.
- ThreatFabric linked a Brokewell C2 server to a repository for the Brokewell Android Loader, which its developer made publicly available to bypass Android 13+ restrictions on Accessibility Service for sideloaded apps.
- The researchers say the malware is in active development, with commands added almost daily, and warn that its device-control capabilities could facilitate fraud that is harder to detect.
Article Details
- Attack Vectors
- A fake browser-update page lured victims into downloading and installing an Android application containing Brokewell.
- Brokewell uses overlays to present bogus screens over targeted applications and capture credentials.
- Brokewell opens legitimate websites in its own WebView, captures session cookies after login, and sends them to its command-and-control server.
- Brokewell abuses Accessibility Service to log device events and to remotely control infected devices, including screen streaming and simulated user actions.
- A Brokewell Android Loader developed by the same developer is designed to bypass Android 13+ Accessibility Service restrictions for sideloaded applications.
- Defensive Notes
- The article recommends a multilayered fraud-detection solution combining device, behavior, and identity risks for each customer.
- ThreatFabric reports that the Brokewell loader is publicly available and may lower barriers to distributing mobile malware on devices running Android 13 or later.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 00d35cf5af2431179b24002b3a4c7fb115380ebda496d78849bf3d10055d8a88 | SHA-256 hash listed in the article's IOC appendix for a Brokewell sample labeled ID Austria. |
| SHA256 | d807070973bde0d85f260950dc764e46a0ba486f62da3e62f3b229ca3ea322f1 | SHA-256 hash listed in the article's IOC appendix for a Brokewell sample labeled GοοgΙe Chrοme. |
MITRE ATT&CK
T1406Brokewell's commands include downloading and installing applications, including a self-update APK.T1417.001Brokewell collects call history and SIM-card information through its supported commands.T1429Brokewell can record audio for a specified duration.T1430Brokewell has a command to collect geolocation from the infected device.T1433Brokewell supports screen streaming and remote actions such as clicks, swipes, scrolling, and text entry on infected devices.T1437.001The fake browser-update page is used to lure victims into installing a malicious Android application.T1513Brokewell's commands can capture screenshots using Accessibility Service.T1517Brokewell records Accessibility events, including touches, swipes, displayed information, text input, and opened applications.T1539 · Steal Web Session CookieBrokewell captures session cookies from its WebView after victims log in to legitimate websites and sends them to its C2 server.T1626.001The Brokewell Android Loader is described as bypassing Android 13+ Accessibility Service restrictions for sideloaded applications.T1628.002Brokewell displays bogus overlay screens over targeted applications to capture credentials.