“Malware Flu Horse Targets Android Users in East Asia for Sensitive Data Theft: Check Point Research”

TEMPO.CO, Jakarta – Expert cyber security from Check Point Research find new operations of malware (malicious software alias malware) targeting the user Android in East Asia. The cyber threat actor created the app mobile clone to trick people into downloading and installing it.

The duped will then share sensitive personal data, including account credentials, banking details, and two-factor authentication codes (two-factor authentication or 2FA) to hackers. Using even a strong password will not protect the victim in this case.

Researchers say malware with the nickname “Flu Horse” and reports that the developer has been active since a year ago. Flu Horse is distributed via email phishing (deception) to high-potential targets to download apps and resolve pending payment issues.

Low Effort

A number of malware Flu Horse sent by e-mail phishing among others is Taiwan’s electronic toll payment application “ETC”, Vietnam’s banking application “VPBank Neo”, and an unnamed transportation application. The official versions of ETC and VPBank Neo have more than 1 million downloads, while the transportation app is only 100 thousand.

According to researchers, Flu Horse’s developers did not really attempt to completely copy a legitimate app, but only copied a few parts of the interface design. As soon as the victim enters their account credentials and credit card details, the application will display a “system is busy” message in an attempt to buy time while the process of stealing the data. Malware FluHorse is also capable of capturing two-layer security codes aka 2FA.

Advertisement

A common characteristic of any email-borne Android attack is inviting the victim to quickly download an illegal application from a third-party repository. The app will then ask for too many access permissions.

To stay safe, use common sense in sorting out suspicious emails. Emails from legitimate companies rarely make urgent requests. Official applications are also only available on official app stores like the Play Store, not third-party repositories whose origins are unclear. Finally, apps that ask for access permissions excessively are also a big red flag.

Editors’ Choice: 12 Ways to Avoid Phishing, Don’t Do This

NIA HEPPY | SYAHDI MUHARRAM