Bankosy Malware Takes the Liberty of Forwarding Your MFA Text Codes

There is a lot of emphasis put on enabling multi-factor authentication (MFA) these days. If you use mobile banking, for example, this extra step will require your login credentials and some other code to be entered before you gain access. Often, this one-time code is sent via text message, sometimes it is retrieved from a key fob that generates random one-time codes. In the case of the malware Bankosy, it’s a code delivered via an automated phone call.

This one targets Android devices and can enable silent mode on the device so the victim is less likely to be alerted when the call with the code arrives. Then the code is forwarded to the attackers. Presumably the attackers already have the corresponding login credentials, so they then have all they need to get to the targeted financial accounts.

2

1.  It is important to take advantage of multi-factor authentication options when they are offered. However, be aware that even those can be intercepted.

2.  Install anti-malware and anti-virus software on your devices. Even though Android is targeted more often due it’s open architectures, iOS devices are being affected more often these days.

3.  Keep all devices updated with the latest patches. These fixes are issued when a vulnerability is found and those vulnerabilities are what the cyber criminals often use to get malware onto devices.

4.  Learn how to identify phishing and if you believe you have received a phishing email pretending to be your financial institution, contact them to make them aware of it. Large and well-known banks are often used very successfully to con people out of their credentials. However, smaller institutions are being used more often as well. Always be aware of phishing and when in doubt, don’t click or open, especially if the link or attachment is unexpected.

5.  If you do receive an unsolicited email message requesting you click to verify any account information, don’t click it. Instead, go directly to your account using a previously bookmarked link and verify your information that way.

In a technical write up in 2014 of Bankosy, Symatec found that the malware also prompted the victims to provide payment card information. Therefore, never put in payment card information when prompted after you’ve entered the one-time code. If you are asked, contact your financial institution. They should be able to tell you exactly how the process works and help you identify potential problems.