Xenomorph Android Malware Targets Banks and Crypto Wallets Across Multiple Countries
Summary
ThreatFabric analyzed a Xenomorph campaign distributed through phishing pages posing as Chrome updates. It targets over 100 banking and crypto apps, with more than 3,000 downloads in Spain and additional activity in the US and Portugal.
Key points
- Xenomorph overlays impersonate targeted apps to steal credentials, payment-card details, and other personal information; its accessibility-enabled ATS can automate actions and control devices.
- New commands add screen-awake notifications, app mimicry, and simulated taps, though the mimic feature was disabled in the observed samples.
- Phishing pages posing as Chrome updates distributed malicious Android APKs. Researchers counted over 3,000 downloads in Spain and more than 100 each in the United States and Portugal.
- The campaign’s target list grew to more than 100 banking and crypto applications per sample, including institutions in the United States, Portugal, Spain, Italy, Belgium, and Canada.
- The exposed distribution server also held files linked to RisePro and LummaC2 desktop stealers. Researchers said it may serve multiple operators or a distribution service; they could not determine which.
- RisePro samples used raw TCP sockets over port 50500 for command-and-control communications and data exfiltration, a change from HTTP.
Article Details
- Attack Vectors
- Phishing webpages impersonating a Chrome update tricked victims into installing malicious APKs, including Xenomorph.
- Xenomorph used overlays resembling targeted applications' login pages to capture personal and financial information.
- Xenomorph used accessibility-service privileges for remote device control and automated sequences of on-device actions.
- Xenomorph retrieved overlays from URLs supplied by its control server.
- The distribution server also hosted or distributed files linked in the article to RisePro and LummaC2 stealer infections.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 92l[.]info | Identified as a phishing server used in the Xenomorph distribution campaign. |
| DOMAIN | airlinesimulator[.]io | Identified as a Xenomorph overlay server. |
| DOMAIN | fobocontentplus[.]online | Identified as a Xenomorph C2 server. |
| DOMAIN | fobocontentplus[.]site | Identified as a Xenomorph C2 server. |
| DOMAIN | fobocontentplus[.]top | Identified as a Xenomorph C2 server. |
| SHA256 | 257f041d1b6ed82808cd8ef07ec84cf141c38e5374b654de46879a3bc180c79c | SHA-256 hash of a Xenomorph sample listed in the article. |
| SHA256 | 259e88f593a3df5cf14924eec084d904877953c4a78ed4a2bc9660a2eaabb20b | SHA-256 hash of a Xenomorph sample listed in the article. |
| SHA256 | e2646afca109162f66b117ca8a7feed0272ab6d8822132dafd2d54d7553cbfde | SHA-256 hash of a Xenomorph sample listed in the article. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationXenomorph's overlays and hardcoded configuration were encrypted, including with AES.T1041 · Exfiltration Over C2 ChannelRisePro used its C2 communication channel to exfiltrate data.T1095 · Non-Application Layer ProtocolRisePro used raw TCP sockets over port 50500 to communicate with its C2.T1105 · Ingress Tool TransferThe article reports malicious APK distribution and Xenomorph overlay retrieval from remote servers.T1417.002Xenomorph displayed overlays resembling targeted apps' login pages to capture victim information.T1453Xenomorph used accessibility-service privileges to remotely control infected devices and run ATS actions.T1476Phishing webpages posing as a Chrome update distributed malicious APKs to victims.T1516The clickOnPoint command simulated touches at specified screen coordinates, and ATS operations could perform UI actions.T1626.001A Xenomorph module was described as obtaining administrator access on Xiaomi devices.
Malware
CabassousThe second case dates back to 2022, with the same infrastructure distributing both Medusa and Cabassous.ERMACThe first case is still connected to Xenomorph, being distributed side-by-side with Ermac payloads using Zombinder droppers.ExobotCompactIt is worth noting that, a few days before the publishing of this article, the drop point change payload, started distributing ExobotCompact/Octo.LummaC2In the following sections we cover two interesting files: "phoneoutsourcing.exe" related to RisePro stealer and "647887023.png" being one of the stages leading to infection with LummaC2 stealer.MedusaThe second case dates back to 2022, with the same infrastructure distributing both Medusa and Cabassous.Octoacross the Atlantic Ocean, including the most distributed MaaS (Malware-as-a-Service) families, such as Octo, Hydra, and Hook, and some of the most notorious privately operated families, such as Anatsa.Private LoaderStealer on the Rise: RisePro stealer with Private Loader tracesRiseProIn the following sections we cover two interesting files: "phoneoutsourcing.exe" related to RisePro stealer and "647887023.png" being one of the stages leading to infection with LummaC2 stealer.XenomorphA New Xenomorph Campaign
Products
AndroidStop uninstall procedure in Samsung using API 29 (Android 10)Google AuthenticatorGets Google Authenticator 2FA codesGoogle ChromeIn these cases, the malware was distributed through phishing pages posing as a Chrome update.MIUIDisable Doze mode (Xiaomi MIUI) - version 1One UIThe list includes multiple modules dedicated to precise actions for specific Mobile User Interfaces based on AOSP (Android Open Source Project), for example MIUI in the case of Xiaomi or One UI in the case of Samsung.
Countries
BelgiumThese areas include Spain, Portugal, Italy, Canada, and Belgium.CanadaThese areas include Spain, Portugal, Italy, Canada, and Belgium.ItalyThese areas include Spain, Portugal, Italy, Canada, and Belgium.PortugalThis new list adds dozens of new overlays for institutions from the United States, Portugal, and multiple crypto wallets, following a trend that has been consistent amongst all banking malware families in the last year.SpainThreatFabric was also able to analyse an ongoing campaign, with thousands of downloads of Xenomorph in Spain and the United States.United StatesThis new list adds dozens of new overlays for institutions from the United States, Portugal, and multiple crypto wallets, following a trend that has been consistent amongst all banking malware families in the last year.