<\/div>\n

BingoMod is a new Android malware that can wipe devices after stealing money from the victims’\u00a0bank accounts.<\/h2>\n\n\n\n

Researchers at Cleafy discovered a new Android malware, called ‘BingoMod,’ that can wipe devices after successfully stealing money from the victims’\u00a0bank accounts.<\/p>\n\n\n\n

The Cleafy TIR team discovered the previously undetected malware at the end of May 2024. BingoMod\u00a0was designed to initiate money transfers from the compromised devices via\u00a0Account Takeover\u00a0(ATO) using a well-known technique, called\u00a0On Device Fraud\u00a0(ODF). The malware can bypass bank users\u2019 identity verification and authentication processes, it also avoids behavioural detection techniques applied by banks to identify suspicious money transfers.<\/p>\n\n\n\n

<\/gwmw>Once installed on the victim\u2019s device, BingoMod leverages various permissions, including\u00a0Accessibility Services<\/strong>, to quietly steal sensitive information, including credentials, SMS messages, and current account balances. <\/p>\n\n\n\n

The malicious code can also conduct overlay attacks and relies on VNC-like functionality to remotely access the compromised device. The researchers noticed that the malware typically wipe infected devices after a successful fraudulent transfer, in an attempt to hinder forensic investigations.<\/p>\n\n\n\n

Cleafy observed the BingoMod targeting devices using English, Romanian, and\u00a0Italian languages, however comments in the malware code suggest the authors may be\u00a0Romanian.<\/p>\n\n\n\n

The malware is in a development phase, the researchers reported that the authors are testing obfuscation techniques to\u00a0avoid detection. <\/p>\n\n\n\n

“BingoMod<\/strong>\u00a0belongs to the modern RAT generation of mobile malware, as its remote access capabilities allow Threat Actors (TAs) to conduct\u00a0Account Takeover\u00a0<\/strong>(ATO) directly from the infected device, thus exploiting the\u00a0On Device Fraud\u00a0<\/strong>(ODF) technique. This consolidation of this technique has already been seen recently by other banking trojans, such as\u00a0Medusa<\/a>,\u00a0Copybara<\/a>, and\u00a0Teabot<\/a>.” reads the report<\/strong><\/a> published by Cleafy. “These techniques have several advantages: they require less skilled developers, expand the malware’s target base to any bank, and bypass various behavioural detection countermeasures put in place by multiple banks and financial services.”<\/em><\/gwmw><\/p>\n\n\n\n

All the samples analyzed by the researchers are\u00a0disguised\u00a0as legitimate\u00a0mobile security\u00a0apps that are distributed via smashing<\/a>.<\/p>\n\n\n\n

After installation, BingoMod prompts users to activate Accessibility Services under the guise of necessary app functionality. Then the app unpacks and executes its malicious payload, before locking the user out of the main screen to gather device information and establish a C2 communication channel.<\/p>\n\n\n\n

Once activated, BingoMod malware uses keylogging and SMS interception to steal sensitive information like login credentials and transaction authentication numbers. The malware supports around 40 remote control functions, including real-time screen monitoring through regular screenshots and full device control via Accessibility Services, allowing attackers to operate the device as if they were physically present.<\/p>\n\n\n\n

The malware performs on-device fraud (ODF) by establishing a socket-based channel to receive commands and an HTTP-based channel to send a feed of screenshots.<\/p>\n\n\n\n

<\/a><\/figure>\n\n\n\n

“On the malware side, the VNC routine abuses Android’s Media Projection API to obtain real-time screen content. Once received, this is transformed into a suitable format and transmitted via HTTP to the TAs’ infrastructure.” continues the report.\u00a0“An exciting feature of the routine is leveraging Accessibility Services to impersonate the user and enable the screen-casting request, exposed by the Media Projection API.”<\/em><\/p>\n\n\n\n

BingoMod can also disable security solutions or block specific apps. The malware uses code-flattening\u00a0and\u00a0string\u00a0obfuscation\u00a0techniques to avoid detection.<\/gwmw><\/p>\n\n\n\n

“BingoMod shows relatively straightforward functionalities commonly found in most contemporary RAT, such as HiddenVNC for remote control and SMS suppression to intercept and manipulate communication and logging user interactions to steal sensitive data. The emphasis on obfuscation and unpacking techniques suggests that the developers may lack the sophistication or experience of more advanced malware authors.” concludes the report. “One notable aspect of this malware is its device-wiping capability, triggered after a fraudulent transaction. This behaviour is reminiscent of the Brata malware, which also employed device-wiping to cover its tracks and hinder forensic analysis.”<\/em><\/gwmw><\/p>\n\n\n\n

Pierluigi Paganini<\/strong><\/a><\/p>\n\n\n\n

Follow me on Twitter: @securityaffairs<\/strong><\/a> and Facebook<\/strong><\/a> and Mastodon<\/a><\/p>\n\n\n\n

(<\/strong>SecurityAffairs<\/strong><\/a>\u00a0\u2013<\/strong>\u00a0hacking, malware)<\/strong><\/gwmw><\/gwmw><\/gwmw><\/gwmw><\/gwmw><\/p>\n","protected":false},"excerpt":{"rendered":"

BingoMod is a new Android malware that can wipe devices after stealing money from the victims’\u00a0bank accounts. Researchers at Cleafy discovered a new Android malware, called ‘BingoMod,’ that can wipe devices after successfully stealing money from the victims’\u00a0bank accounts. The Cleafy TIR team discovered the previously undetected malware at the end of May 2024. BingoMod\u00a0was […]<\/p>\n","protected":false},"author":1,"featured_media":166415,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3323,3,7,2624],"tags":[276,15251,88,4112,9508,9506,10918,30,687,841],"class_list":["post-166410","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-breaking-news","category-cyber-crime","category-malware","category-mobile-2","tag-android","tag-bingomod","tag-cybercrime","tag-hacking","tag-hacking-news","tag-information-security-news","tag-it-information-security","tag-malware-2","tag-pierluigi-paganini","tag-security-affairs"],"yoast_head":"\n