wn financial and shopping apps, cryptocurrency exchanges and social media and messaging apps – including Twitter, WhatsApp, Facebook, Amazon, Netflix, Outlook, eBay, Coinbase, Plus500, Cash App, BBVA and Lloyds Bank.

The trojan swipes credentials using an overlay attack – which is a common type of attack for malicious Android apps. In this type of attack, the malware will create a data-stealing overlay of the application that the victim is navigating to, and request the user to log in. However, while the victim believes he is logging in, he is unwittingly handing over his credentials to the cybercriminals. See Also: Hacking Stories: Albert Gonzalez & the ‘Get Rich or Die Trying’ Crew who stole 130 million credit-card numbersIn a commonly-used tactic by Android malware, the malicious app also asks the victim to enable accessibility services on the phone in order to grant itself permissions on the phone without the victim’s knowledge (Android says that accessibility services are typically used to assist users with disabilities in using Android devices and apps). These permissions give the malware to access contacts, camera, SMS messages and more. This ability to intercept SMS messages is also handy for threat actors looking to get around SMS-based two-factor authentication (2FA) protections set up by the apps on the victims’ phone (if an app sends a 2FA code, for instance, attackers can pick it up via viewing the text messages). https://media.threatpost.com/wp-content/uploads/sites/103/2021/03/19101452/figure-2b-170x300.png The malware’s installation prompt. Credit: ESET
The biggest clue that this app is malicious is that its name is “Install” rather than “Clubhouse,” Stefanko said.

“While this demonstrates that the malware creator was probably too lazy to disguise the downloaded app properly, it could also mean that we may discover even more sophisticated copycats in the future,” he said.

Even as its popularity grows, Clubhouse has come under fire for various privacy issues, such as the fact that conversations via the app are recorded. France’s privacy watchdog also recently opened an investigation into the app over how it protects the privacy of European users’ data.

While this malicious app is in no way affiliated with the legitimate Clubhouse app itself, researchers warn that more sham Clubhouse apps will appear in the future – particularly while the demand for a yet-to-be rolled out Android version continues.
Android users can protect themselves by always sticking to official mobile app marketplaces to download apps to their devices, staying wary of the permissions they grant to applications and keeping their devices up to date (via patching and otherwise).
Source: https://threatpost.com (Click Link)style="display:block"
data-ad-client="ca-pub-6620833063853657"
data-ad-slot="8337846400"
data-ad-format="auto"
data-full-width-responsive="true"> Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/apple-security-90x90.jpg Trojanized Xcode Project Slips MacOS Malware to Apple Developers3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/Cisco_Systems_Sign-90x90.jpg Cisco Plugs Security Hole in Small Business Routers4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/JPG-Malicious-Two-90x90.jpg Magecart Attackers Save Stolen Credit-Card Data in JPG Files5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/Google-Chrome-Browser-1-90x90.jpg Google Warns Mac, Windows Users of Chrome Zero-Day Flaw6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/internet-of-things-90x90.jpg Critical Security Hole Can Knock Smart Meters Offline1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/Linux-kernel-vulnerability-90x90.png Linux Systems Under Attack By New RedXOR Malware1 week ago[...]

* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/security-camera-90x90.jpg Breach Exposes Verkada Security Camera Footage at Tesla, Cloudflare2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/ezgif.com-gif-maker-1-90x90.jpg Apple’s Device Location-Tracking System Could Expose User Identities2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/recaptcha-90x90.jpg Fake Google reCAPTCHA Phishing Attack Swipes Office 365 Passwords2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/botnet-90x90.jpg D-Link, IoT Devices Under Attack By Tor-Based Gafgyt Variant2 weeks ago
The post Bogus Android Clubhouse App Drops Credential-Swiping Malware first appeared on Black Hat Ethical Hacking.

Hacking on Medium
I NEED A HACKER TO CHANGE MY TRANSCRIPT CONTACT: QULIOUSHACKER@GMAIL.COM

CONTACT: QULIOUSHACKER@GMAIL.COM — -IF YOU HAVE HACKING RELATED ISSUES CONCERNING HOW TO HACK AND CHANGE YOUR UNIVERSITY GRADES AND…

Continue reading on Medium »

Hacking on Medium
I NEED A HACKER TO CHANGE MY UNIVERSITY T CONTACT: QULIOUSHACKER@GMAIL.COM

CONTACT: QULIOUSHACKER@GMAIL.COM — -IF YOU HAVE HACKING RELATED ISSUES CONCERNING HOW TO HACK AND CHANGE YOUR UNIVERSITY GRADES AND…

Continue reading on Medium »

Hacking on Medium
HOW TO HACK PORTAL CONTACT: QULIOUSHACKER@GMAIL.COM

https://cdn-images-1.medium.com/max/600/0*kEcvgWIhRk61nVDA.jpeg
CONTACT: QULIOUSHACKER@GMAIL.COM — -IF YOU HAVE HACKING RELATED ISSUES CONCERNING HOW TO HACK AND CHANGE YOUR UNIVERSITY GRADES AND…

Continue reading on Medium »

Hacking on Medium
Network Discovery and Security Auditing with Nmap

https://cdn-images-1.medium.com/max/1920/1*cw6Gql7-97AnSCll0z9cMw.jpeg
Nmap “Network Mapper” is a free and open-source tool used for network discovery and security auditing. Many systems and network…

Continue reading on Dev Genius »

Hacking on Medium
HOW TO HACK WEBSITE ADMIN PASSWORD CONTACT: QULIOUSHACKER@GMAIL.COM

CONTACT: QULIOUSHACKER@GMAIL.COM — -IF YOU HAVE HACKING RELATED ISSUES CONCERNING HOW TO HACK AND CHANGE YOUR UNIVERSITY GRADES AND…

Continue reading on Medium »

Hacking on Medium
48h en la DarkWeb

https://cdn-images-1.medium.com/max/2600/0*6VP3FSbFlEhMroXX
He pasado 48h en la DarkNet y esto es lo que he encontrado. ¿Qué es? ¿Cómo funciona? ¿Qué hay dentro? ¿Es seguro?

Continue reading on La region vulnerable »

Trending repositories on GitHub today · GitHub
infosecn1nja / AD-Attack-Defense

Attack and defend active directory using modern post exploitation adversary tradecraft activity

Language: unknown
Star:
Fork:

Trending repositories on GitHub today · GitHub
Developer-Y / cs-video-courses

List of Computer Science courses with video lectures.

Language: unknown
Star:
Fork:

LAZYPARIAH — Low-Dependency CLI Tool for Generating Reverse Shell Payloads
https://skynettools.medium.com/lazypariah-low-dependency-cli-tool-for-generating-reverse-shell-payloads-97b217bc012f?source=rss------bug_bounty-5

Continue reading on Medium » (https://skynettools.medium.com/lazypariah-low-dependency-cli-tool-for-generating-reverse-shell-payloads-97b217bc012f?source=rss------bug_bounty-5)

LAZYPARIAH — Low-Dependency CLI Tool for Generating Reverse Shell Payloads

Continue reading on Medium »
Read more...