Marcher banking malware hitting Android phones in Australia
Marcher Madness continues with a new, stealthier iteration of the Marcher banking malware targeting Android users in Australia.
In a new post, Oren Kiriat, a mobile information security analyst at Check Point, details the process of an attack from the malware, which first reared its head in 2013 targeting mainly Google Play users in Russia to siphon off their credit card details by displaying a phony credit card entry page. By March 2014, however, the malware – available as malware-as-a-service on underground web forums – had evolved its capabilities to include bank credential theft and began spreading among online bank users in Germany. And recently, Check Point researchers say, a new Marcher campaign launched via porn sites.
It spreads through phishing campaigns where targets receive spoofed emails that appear to be legitimate but might include suspicious addresses. If a recipient clicks on a link, they are then tricked into enabling installation from unknown sources outside Google Play and a malicious app is downloaded.
