Spy Banker Trojan Uses Facebook to Steal Banking Credentials

It is true that you shouldn’t always believe what you see on Facebook, or any social media for that matter. Facebook has established itself as a trustworthy platform for sharing and cybercriminals prey on this and use it to spread malware. In a recent instance, the banking malware Spy Banker has been spreading like wildfire that way.

Spy Banker has been around for quite some time, but it has recently had a resurgence targeting Portuguese speakers, but not only in Brazil or Portugal. U.S. victims have been reported as well. It uses social engineering by attempting to get users to click links that take them to a server hosted on Google’s cloud platform that installs the Telex Trojan on the machine. Then it gets to work stealing online banking credentials.

The links promise coupons, good deals, tax return help, and has disguised itself as WhatsApp, the popular chat app used by 9 million people worldwide, and anti-virus programs.

A few ways to avoid becoming a victim of such tactics are:

• Don’t blindly click links you see on social engineering sites or in email messages. This is particularly true if you don’t know the source or are not expecting it. For example, if you get an email from your mom and all it says is “Hi, it’s me” and is immediately followed by a link and nothing else, it’s probably malicious.

• Take a moment to verify a link before clicking it, even when it comes from a trusted source. Hover over it with the mouse to see where it goes. If you expect it to go to your favorite retail store, make sure that store name appears in the link. If it is shortened using a URL shortening product such as is the case with this one, it should be considered suspect and you should not click it. To verify on a touch device, such as a tablet, hold down on the link for a couple of seconds and an additional box will appear showing the entire link. Then you can choose what to do next from there.

• If you click on ads shown on social media sites, make sure they are legitimate too and not just click bait. That old adage that if it’s too good to be true, it probably is should be given consideration.

• Consider ad blocking software if you don’t want to see ads. It will block any ads appearing on pages of browsers and social media sites. There are many to choose from and many are free or donation-based. Do your research and find the one that is from a legitimate source and best fits your needs and budget.

• Make sure you have anti-malware products installed on all devices, including mobile ones and anything running Apple operating systems. Although they are typically not as vulnerable to malware, they are becoming a bigger target every day. Therefore, it is better to be covered when the next one comes out in the wild. Keep it updated at all times.

• If you are installing apps on your devices, don’t sideload. Make sure you get them from the official app stores. Getting them from locations other than these places adds risk of infecting your devices.

This one doesn’t just steal banking credentials. Because it does connect back to a command and control center, the perpetrators are also able to send additional commands to the infected device, push through additional malware, and perform other functions.

Google has cleaned the servers with the offending products and now a “404 Not Found” error appears when the site it his. The hosting service, GoDaddy, has also removed five offending sites. However, there is one more that is registered to the same person that still has been seen as active.