SlemBunk Trojan Evolving Quickly; It Can Steal Credentials and Then Maybe Do It Again

In December, the mobile banking Trojan, SlemBunk was discovered and looks like a slam dunk for criminals. At the time, it was considered a pretty nasty piece of malware. However, more has been found that makes it even more nefarious, attempting to stay a few steps ahead of everyone else. Researchers at FireEye now say the administrative server at the Command and Control center for it is customizable. This means that the payload of SlemBunk can likely easily adapt according to specifications set by the attacker's and will likely evolve over time. It also means it will be more difficult to detect and track.

This Trojan is designed to mimic banking apps and steal login credentials. Criminals are getting better at doing this, so it’s important to know the app your bank uses and download it from the official app stores for your devices.

In addition, when going online from your laptop or desktop, make sure you bookmark your financial institution’s link so that you are confident it is the correct one each time you visit. Don’t click links in email messages that claim to take you to a banking site. While they may indeed be legitimate, it’s safer to use that bookmark or manually type the URL in the address bar of the browser.

If you just can’t resist that click, hover over it with the mouse pointer for a bit and see where it is actually taking you. If it’s not going where you expect it to, don’t click it.

It's also a good habit to change your online credentials often. A good rule of thumb is to do this at least quarterly. Don't reuse passwords on multiple sites. Password reuse is becoming a favorite method for cybercriminals to do damage. Already this year, it's been blamed for the Fitbit Warranty fraud incident and the TaxAct issue. While this wouldn't prevent someone from using them to immediately empty your accounts, often the criminals will wait before giving them a try. So, changing them often will potentially keep your money in your account instead of theirs.

SlemBunk appears to be part of a well-organized and recent campaign, according to FireEye. It requests permission to run as administrator and often arrives via Facebook’s Messenger application, WhatsApp, and other messaging applications. Once it is given administrator rights, it will lurk in the background and spy, attempting to steal online banking credentials.

If an app asks for administrator rights, you should deny that request. There are very few, if any legitimate apps that need this access, so be suspicious if one makes such a request. Likely, it’s malware.

Researchers are keeping an eye on this one. However, because it seems to be changing, it’s up to us to use our knowledge of what to look for and stay one step ahead of it rather than letting it get the upper hand.