

Mobile Threat Monday: Android Wallet Steals Bank Info and Mysterious iOS Malware

Another malicious double feature on Mobile Threat Monday! This week, a nasty Android app steals your banking information and mysterious iOS malware has appeared on jailbroken iPhones.

April 21, 2014

Today on Mobile Threat Monday, it's another double-feature. First up, F-Secure analyzes a nasty piece of Android malware preying on Korean banking customers. Second is a mysterious piece of iOS malware that's been found on jailbroken iPhones.

Trojan My One Mobile Wallet
Most of the time on Mobile Threat Monday, we talk about tricky threats that aren't always easy to understand. Like how leaky apps aren't really malicious but can do a lot of harm. However, today is a lovely exception and is so ridiculously audacious that I can't contain myself. I'll just tell you what it does right now: it screenshots all your banking information. Straightforward, fast, and dirty.

The app in question is a Trojanized version of the legitimate My One Mobile Wallet app, with the same name and appearance as the real thing. We've seen this tactic before, particularly with "cracked" versions of for-pay games. We should stress that the My One Mobile Wallet on Google Play is, by all accounts, a legitimate app. The scammers just lifted its appearance and name for their malicious version, which is probably lurking on third-party app stores.

"As a wallet application, this malware asks a user to fill in bank card details for different Korean Banks," explained F-Secure. "When the user is done filling up the card details and has pressed OK, the app takes a screen shot picture of the card form, and then sends this picture to some defined server." F-Secure believes that the server in question is the Command and Control server for the app.

For extra fun, the malicious app also downloads and installs another APK onto victims' devices. F-Secure isn't sure what was in this bonus application, but I can't imagine it would be anything good.

Because the app targets Korean-speaking victims, and users of Korean banks, its scope is somewhat limited. But in general, Android users should stick to the official Google Play store. It's not perfect, but it does offer some basic protection. Sideloading apps can mean opening yourself up to a world of threats.

Unflod Baby Panda
This iOS malware was first discovered by Reddit users and analyzed by the German security company SektionEins. The malware campaign is being called Unflod Baby Panda, and appears to have originated in China. Thankfully, you won't find this one on the Apple App store—it's exclusively gone after jailbroken phones.

Once on victims' phones, the malware watches outgoing SSL traffic. "From these connections it tries to steal the device's Apple ID and corresponding password and sends them in plaintext to servers with IP addresses in control of US hosting companies for apparently Chinese customers," wrote SektionEins.

The weird thing is that no one is sure how the malware made its way onto iPhones in the first place. It's likely that it sprang from malicious or Trojan apps circulating on third party app stores that cater to iOS jailbreakers.

On the plus side, that means the attack can only affect jailbroken iOS users who install apps from third-party sites. Generally, we don't endorse jailbreaking because of the potential security issue.

Get Our Best Stories!



Thanks for signing up!


Sign up for other newsletters

About Max Eddy

Max Eddy

Read the latest from Max Eddy