New Malware Family Can Take Over Your Android Device

Once again, Android devices are targeted by online banking malware. This is being called Gugi/Fanta/Lime and can bypass security of Android devices running on version 6. Comodo Threat Research Labs found this malware active in Russia so far, but it’s likely to spread all around the world.

Gugi, for short, makes its way onto the devices using phishing techniques. A spam email is sent that contains a link. If that link is clicked, it sends the user to a website where he or she is asked to click another link that initiates the download of the Trojan-Banker.AndroidOS.Gugi.c onto the device.

Once it’s on the device, it tries to get various permissions, including administrator rights. If granted, the malware can view and send text messages, make phone calls, and add or delete contacts, among other things. If the user denies privileges, the malware will lock up the device and the only recourse is to reboot in safe mode and try to uninstall the malware, which can be quite a challenge.

After it takes over the device, it will place overlays on applications such as banking apps and the Google Play store to trick you into thinking those are the real ones. However, they are facades that just look like the actual apps. Then it will steal login credentials when they are entered.

1.  There are many lessons for this one. Always be aware of attempted phishing attacks. Spammers don’t take time off for the holidays and in fact, they may even ramp up activity and send more spam with phishing in them, because advertisers are already sending more offers for online shopping deals. The hope is that you are so inundated that you won’t pay attention and will just click links or popups; but don’t. Pay attention and if you are not expecting a link or attachment, confirm it first or just go directly to the site you want to visit by carefully typing in the URL.

2.  Don’t just click away popups either. With all the sales going on right now with “limited time” offers, it’s easy to get in a hurry before the deal goes away. But take that extra moment to really read the popups and be 100% sure they are real and that you want them before clicking anything. If there is no way to close them without choosing a negative or affirmative button, it is likely malware. Close your browser completely. Don’t just click away the popup message.

3.  Always back up your devices regularly so that should malware strike, it’s quick to restore them from a recent backup. In many cases, if malware makes its way onto your device, you will need to completely erase it and start from scratch. Having a backup that you know is current and safe is very helpful.

4.  Always keep your applications and software up-to-date with the latest security and critical updates. Also, make sure anti-malware and anti-virus programs are installed on all devices and they are kept updated as well. Most of them have an automatic update feature. Enable that and you won’t have to worry about having the latest versions.

5.  Remember to use caution when logging in to public WiFi hotspots. These are extra vulnerable during the holidays when cyber criminals know people will be doing online shopping and likely checking bank accounts often. Wait to do this when you are able to access WiFi that you are confident is secure, such as at home.