Dangerous new 'Hook' Android malware lets hackers remotely control your phone

News
By
published

Hackers could also see your location and steal your files

app security
(Image credit: Shutterstock.com) (Image credit: Shutterstock.com)

Cybersecurity experts have warnedd of a new Android malware capable of taking over the target endpoint and using it to steal data, exfiltrate personally identifiable information (PII), and make financial transactions. 

Discovered by researchers at security firm ThreatFabric, the malware is called Hook, and can be bought on the dark web.

In its report, the ThreatFabric team note that Hook is essentially a banking trojan. Code-wise, it seems to be quite similar to Ermac, another popular trojan, and even shares numerous features with the infamous malware. However, there are a few standout features, including the use of VNC (virtual network computing) to take over the mobile device. Hook also comes with WebSocket communication features, and encrypts its traffic using the AES-256-CBC hardcoded key.

TechRadar Pro needs you! We want to build a better website for our readers, and we need your help! You can do your bit by filling out our survey and telling us your opinions and views about the tech industry in 2023. It will only take a few minutes and all your answers will be anonymous and confidential. Thank you again for helping us make TechRadar Pro even better.

D. Athow, Managing Editor

Unique features

Hook’s other notable features include performing specific swipe gestures, taking screenshots, simulating key presses, scrolling, and simulating a long-press event. The malware can also be used as a File Manager app, the researchers further warned, allowing users to list all of the files residing on the endpoint and exfiltrating the ones they deem worthy. 

"With this feature, Hook joins the ranks of malware families that are able to perform full DTO, and complete a full fraud chain, from PII exfiltration to transaction, with all the intermediate steps, without the need of additional channels," the team warns.

Read more

> Watch out - this Android malware has been installed millions of times already

> Wi-Fi routers are being hit by a dangerous new Android malware with extra DNS hacks

> Here are the best firewalls around right now

"This kind of operation is much harder to detect by fraud scoring engines, and is the main selling point for Android bankers."

The silver lining, as is usual with Android devices, is that the user needs to grand the Accessibility Service permissions for the malware to reach its true potential. Those that do, can also expect their location to be revealed, as Hook is also able to abuse the “Access Fine Location” permission.

Targets are scattered all over the world, it seems, with researchers finding compromised devices in the US, the UK, Spain, Poland, Portugal, Italy, France, Canada, Australia, and Turkey.

Via: BleepingComputer

TOPICS
Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.