New Malware Marches On Using A Trifecta Of Attack Methods

One method of malware infection just isn’t enough anymore. Combining multiple attack methods seems to be the malware authors’ weapon of the future. In a recent one, targeting Android operating systems called DoubleLocker, malware had a two-part approach by locking up the device and stealing from you. Well, that just wasn’t enough for the authors of a new one that takes a three-pronged approach. It rolls phishing, payment card data theft, and a banking Trojan into a trifecta of trouble.

Marcher, as it’s being called, was first found back in March of 2013. As is with DoubleLocker, this one also uses a fake Adobe Flash update to infect the device. Once again, remember that Adobe Flash is no longer supported for Android and therefore, you will not receive legitimate updates for it for Android. So, if you see one, you should certainly be suspicious.

Usually, a phishing message circulates via SMS/text, or smishing. However, it’s has also been found in email messages with a truncated link. If that link is clicked, a fake banking website appears, and a personal information is requested.

Once the requested information is obtained, attacks begin using that data and additional links are sent that include the Marcher malware.  Ultimately, the malware is after payment card details and it asks each time the Google Play Store is accessed. Then it will ask for more permissions, such as access to make voice calls, read and write messages, access contacts, and much more.

Other than not falling for fake Adobe Flash updates, use caution when clicking links in email messages or in texts. If they are not expected, consider them suspect. Don’t sideload applications from third party websites either. Even though the official app stores are not a total guarantee for safe apps, the apps that are in those do go through additional security scrutiny before they are allowed in.

And this is very important. If any application asks for administrator access, do not grant it. Realistically, you are not ever likely to come across one that truly needs these. Also, be cautious of what permissions you do give any app. If it’s a flashlight app, for example, it doesn’t need access to your microphone or contact list.

Another precaution is to use a VPN on your device. Marcher and others rely on unencrypted connections to bypass the security on the device. A VPN encrypts the data between the connection points.

Finally, make sure there is anti-virus software installed on all internet-connected devices. This is a fairly simple and inexpensive step forward for keeping your information more secure.