Red Alert Android Banking Trojan Uses Overlays and SMS Abuse to Steal Credentials
Malware Intelligence · 2 sources · Updated 3mo ago · First seen Sep 20, 2017
The Android banking trojan Red Alert was observed targeting more than 60 banking applications across multiple countries, along with at least one social platform, Instagram, by displaying fake login overlays when victims opened selected apps. The malware checked which application was in the foreground and then pulled the appropriate overlay configuration from its command-and-control infrastructure, allowing it to capture usernames, passwords, and other entered data and send them back to attackers.
Researchers reported that Red Alert 2.0 was being distributed through third-party Android app stores while posing as legitimate software such as WhatsApp, Viber, Android updates, and Flash Player updates. Beyond credential theft, the trojan supported SMS interception and sending, changing the default SMS app, collecting contacts and call data, issuing USSD commands, launching apps, requesting admin privileges, and blocking incoming calls from banks to interfere with fraud checks; it was also reportedly advertised on underground forums for $500, raising concerns that more criminals could deploy it against Android devices up to version 6.0.
