Xenomorph V3 Adds Automated Transfer Fraud and Targets More Than 400 Institutions
Summary
ThreatFabric analyzes Xenomorph.C, an Android banking trojan with an Accessibility-powered engine for automated transfers, MFA-code and cookie theft. A test configuration listed more than 400 banking and cryptocurrency targets.
Key points
- ThreatFabric identifies Xenomorph.C as a major update to the Android banking trojan attributed in the article to the Hadoken Security Group.
- Its Accessibility-powered runtime engine executes ATS scripts that can automate fraud, including account-data collection and fund transfers.
- A described script can extract MFA codes from an authenticator app while the malware operates on the same device.
- The malware can steal session cookies from a controlled browser and send them to its command-and-control server, enabling account takeover.
- A test sample's configuration listed more than 400 banking and cryptocurrency targets, over six times the number in an earlier sample.
- The analyzed deployment used a Zombinder app disguised as a currency converter, which downloaded an app posing as Google Protect; some test samples were hosted on Discord CDN.
- ThreatFabric reports that the actors advertised the malware, suggesting an intention to enter the malware-as-a-service market; wider distribution was an expectation, not a confirmed outcome.
Article Details
- Attack Vectors
- Xenomorph v3 is deployed through a Zombinder app bound to a legitimate currency converter; the app downloads an application posing as Google Protect as an update.
- The malware uses Accessibility services to execute ATS scripts, automate actions in banking applications, collect credentials and MFA codes, and complete fraudulent transactions.
- Xenomorph uses overlay attacks and keylogging to gather personal information, including usernames and passwords.
- A malware-controlled browser with JavaScript enabled displays targeted pages and extracts session cookies through Android CookieManager.
- Test samples were hosted on Discord CDN; the article says these samples were likely shared there rather than distributed as part of a campaign.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cofi[.]hk | C2 server identified for Xenomorph live campaigns. |
| DOMAIN | dedeperesere[.]xyz | C2 server identified for Xenomorph live campaigns. |
| DOMAIN | inj[.]had0[.]live | Injection server identified for Xenomorph test samples. |
| DOMAIN | jobviewer[.]co | Injection server identified for Xenomorph live campaigns. |
| DOMAIN | team[.]mi1kyway[.]tech | C2 server identified for Xenomorph test samples. |
| DOMAIN | vldeolan[.]com | C2 server identified for Xenomorph live campaigns. |
| SHA256 | 15e3c87290957590dbaf4522645e92933b8f0187007468045a5bd102c47ea0f4 | SHA-256 of the CoinCalc Zombinder sample associated with Xenomorph distribution. |
| SHA256 | 88d3cb485f405a6cec9d14e9ee2865491855897bfc9a958c0e7c06485a074d02 | SHA-256 of a Xenomorph V3 sample named Play Protect. |
| SHA256 | 9ce2ad40f3998860ca1ab21d97ea7346bf9d26ff867fc69c4d005c477c67a899 | SHA-256 of a Xenomorph V3 sample named Play Protect. |
MITRE ATT&CK
T1417.001The article identifies keylogging as a means Xenomorph uses to collect PII.T1417.002Xenomorph uses overlay attacks to collect usernames and passwords from targeted users.T1539 · Steal Web Session CookieXenomorph extracts session cookies from its malware-controlled browser using Android CookieManager.T1626.001Xenomorph abuses Accessibility services to execute remote actions and run ATS operations on infected devices.T1636.004Xenomorph supports SMS logging and SMS interception, according to its listed commands.T1646The malware sends extracted cookies to its C2 server; the listed ATS actions also include sending data to C2.T1657 · Financial TheftXenomorph's ATS automates fraudulent transactions and fund transfers on infected devices.
Threat Actors
Malware
Products
Tools
GymDropXenomorph campaigns have always been characterized by short and contained distribution efforts, first via GymDrop, a dropper operation created and managed by the same group, and later via Zombinder, another distributionZombinderefforts, first via GymDrop, a dropper operation created and managed by the same group, and later via Zombinder, another distribution vector that we covered on a previous article in December 2022.
Countries
CanadaNational Bank of CanadaItalya relatively stable set of targets in its configuration, with specific interest in Spain, Portugal, and Italy, with the latest campaigns also introducing Belgian and Canadian institutions, together with somePortugalhas maintained a relatively stable set of targets in its configuration, with specific interest in Spain, Portugal, and Italy, with the latest campaigns also introducing Belgian and Canadian institutions, together withSpainhas maintained a relatively stable set of targets in its configuration, with specific interest in Spain, Portugal, and Italy, with the latest campaigns also introducing Belgian and Canadian institutions,