Android Malware Surge Hits Finland: Urgent Warning for UK Users - Cyber and Fraud Centre

Finnish authorities have exposed a sophisticated Android malware campaign designed to steal banking credentials and drain victims’ accounts. While the attacks are currently concentrated in Finland, the techniques used could easily spread to other countries, including the UK.

Understanding the Threat

This campaign primarily employs “smishing” tactics – fraudulent SMS messages that attempt to trick users into taking an unsafe action. The messages often impersonate banks, financial institutions, or other recognised entities, creating a sense of urgency with claims of unusual account activity or debt collection issues. These messages urge the victim to call a fake customer service number.

During the fraudulent call, the attackers further manipulate the victim into downloading a malicious app disguised as McAfee antivirus software. Once installed, this malware grants cyber criminals far-reaching access to the victim’s device.

The Vultur Connection

Security experts suspect the malware involved may be a new variant of the Vultur banking trojan. Vultur is known for its ability to:

Manage files on the infected device.
Abuse accessibility features of the Android operating system.
Prevent specific apps from launching.
Disable security features.
Push fake notifications.

How to Protect Yourself

The best defence against this type of attack is vigilance and awareness. Here’s what you can do:

Be sceptical of unsolicited text messages and calls. Banks and legitimate institutions will not ask you to download software or provide sensitive information over the phone, especially in this manner.
Never download apps from outside of official app stores. Stick to the Google Play Store and always verify the authenticity of applications before installation.
Check app permissions carefully. If an app is requesting excessive permissions that don’t seem necessary for its function (e.g., a flashlight app asking for access to your contacts), do not install it.
Keep your Android device updated. Operating system updates often include security patches that address known vulnerabilities.
Consider using reputable mobile antivirus software. An additional layer of security can help detect and block malicious apps.

What to Do if You’ve Been a Victim

If you suspect your device might be infected, take these immediate steps:

Contact your bank without delay. Discuss potential protective measures and minimise financial damage.
Reset your device to factory settings. This should remove the malware, but ensure you back up any critical data beforehand.
Change passwords for all affected accounts. This includes your online banking and any other services where you might have used the same login details.

Stay Alert, Stay Safe

Although this specific campaign is targeting Finland, the tactics highlight the ongoing dangers of mobile malware which we’ve alerted on before in recent articles. By exercising caution and following the advice outlined above, you can significantly reduce your risk of falling victim to these attacks.

09.05.24

Threat Intelligence Alerts