BankBot Banking Malware Pretends To Be The Official App Store

Popular theatrical events, Oscar nominated movies, and other events often return to the limelight for repeat performances. In this case, online banking malware is back on stage after having been booted out of the Google Play Store earlier in the year. BankBot not only reappeared, but was also redesigned and is new and improved. This time, it is harder to detect because it uses methods to mimic the actual Google Play Store, which comes installed on every Android device.

The actual host for the malware is disguised as a game called “Jewel Star Classic,” according to researchers at ESET. And while it has since been removed, it likely infected over 5,000 devices before the folks at Google discovered it.

The additional damage BankBot can do includes exploiting more of the accessibility services. It also lies waiting in the wings for 20 minutes after the game is played for the first time before it executes. That helps confuse the user by making him or her think merely an update is being installed.

As for the “update,” a screen shows up at some point asking the user to enable “Google Service.” Don’t give it any unnecessary permission. After the BankBot installs, a screen appears asking for a payment card number, supposedly for the Google Play Store. If this sequence of events happens for you, you may well be infected. Reset your device to factory settings and start again.

Some handy advice before downloading apps from any app store:

• Check reviews. They’re not only good for deciding which movie you want to see. They also provide valuable insight into potentially malicious apps you want to install. If there aren’t many reviews, or they are all glowing or don’t seem unbiased, perhaps wait a while to see if more people chime in. It’s kind of the same strategy you would use to choose a restaurant on one of those review apps.

• Avoid being the early adopter of new applications. Even when they are not fake or infected, the early adopters often get stuck with the broken ones. Wait till the developers have had time to fix the early bugs before downloading. These bugs could be holes for hackers to sneak through.

• Keep your devices updated with the latest patches and updates. Often, malicious products take advantage of unpatched devices.

• Install anti-malware on all your devices. Keep it updated at all times.

• Avoid sideloading apps. In this case it was in the actual official store. However, sideloading (installing from third-parties) often adds significantly more risk to damaging your device with malware.

• Keep a current backup copy of your device. Use the cloud or your computer or whatever other means you choose. This can be useful if you do end up with malware on it.