Connect with us

Technology

Android banking Trojan evolves to evade detection and strike globally

Published

on

Android banking Trojan evolves to evade detection and strike globally

Android banking Trojan Medusa has returned after almost a yearlong hiatus and is now even more dangerous. The new variant of the Trojan is lightweight and requests fewer device permissions to avoid detection.

First identified in 2020, Medusa is a Turkish-linked banking Trojan that initially targeted Turkish financial institutions. 

It expanded rapidly by 2022, launching major campaigns in North America and Europe, causing significant monetary harm. Medusa’s new variant is now targeting Android users across the globe, including those located in the U.S., Canada, Spain, France, Italy, the U.K. and Turkey.

A man looking at his Android phone. (Kurt “CyberGuy” Knutsson)

Advertisement

How does the Medusa Android Trojan evade detection?

Since July 2023, Medusa attacks are back with a new version. Cybersecurity experts from Cleafy found a spike in the number of installs of an app called “4K Sports.” This app is being used by hackers to put malware on people’s Android phones. The new malware is an upgraded Medusa with big changes in how it works.

It asks for fewer permissions, making it sneakier. It still requests Accessibility Services, which is a big red flag. Android’s Accessibility Service is a powerful tool that helps people with disabilities use mobile devices more easily. When you grant an app Accessibility permissions, you’re essentially giving it the ability to do whatever it wants on your phone.

CLICK HERE FOR MORE U.S. NEWS

Cybercriminals are aware of this, so most malware that infects your phone will ask for Accessibility permissions. You should be immediately suspicious when an app requests permissions in this area. Medusa’s new variant also requests Broadcasting SMS, Internet Foreground Service and Package Management permissions.

The Android Trojan now has 17 fewer commands than before but adds five new ones, like setting a black screen overlay, taking screenshots and more.

Advertisement

Cleafy reveals that hackers are using not only the 4K Sports app to install Medusa but also fake apps like Google Chrome, InatTV, Purolator and 5G. In the U.S., Chrome, InatTV and Purolator are the main apps being misused by these hackers.

person on android

A person on their Android phone. (Kurt “CyberGuy” Knutsson)

BEST ANTIVIRUS FOR ANDROIDS — CYBERGUY PICKS 2024

What is the scale of the Medusa cyberattack?

Medusa is going after people all over the world, including the U.S. and Europe. Cleafy found two different Medusa botnet groups, each working in its own way.

The first group, with botnets named AFETZEDE, ANAKONDA, PEMBE and TONY, mainly targets people in Turkey but also hits Canada and the U.S. They use Medusa’s usual tricks, like phishing, to spread the malware.

The second group, including the UNKN botnet, shows a change in Medusa’s strategy. It mainly targets European users, especially in Italy and France. Unlike the usual variants, some of these new ones were installed through apps downloaded from untrusted sources. This means the hackers are trying new ways to spread the malware beyond the usual phishing tactics.

Advertisement
cybercriminal

Illustration of a cybercriminal. (Kurt “CyberGuy” Knutsson)

ANDROID BANKING TROJAN MASQUERADES AS GOOGLE PLAY TO STEAL YOUR DATA

10 ways you can protect yourself from the Android banking Trojan

While a Trojan is hard to detect and can be dangerous once it enters your phone, there are several things you can do to protect your data.

1. Be cautious of phishing attempts: Be vigilant about emails, phone calls or messages from unknown sources asking for personal information. Avoid clicking on suspicious links or providing sensitive details unless you can verify the legitimacy of the request.

2. Have strong antivirus software: Android has its own built-in malware protection called Play Protect, but it’s not enough to stop all malicious software. Historically, Play Protect hasn’t been 100% foolproof at removing all known malware from Android phones. The best way to protect yourself from clicking malicious links that install malware that may get access to your private information is to have antivirus protection installed on all your devices. This can also alert you of any phishing emails or ransomware scams. Get my picks for the best 2024 antivirus protection winners for your Windows, Mac, Android and iOS devices.

3. Download apps from reliable sources: It’s important to download apps only from trusted sources like the Google Play Store. They have strict checks to prevent malware and other harmful software. Avoid downloading apps from unknown websites or unofficial stores, as they can pose a higher risk to your personal data and device.

Advertisement

4. Use an identity theft protection service: Identity Theft companies can monitor personal information like your Social Security Number (SSN), phone number and email address and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals. 

One of the best parts of using some services is that they might include identity theft insurance of up to $1 million to cover losses and legal fees and a white glove fraud resolution team where a U.S.-based case manager helps you recover any losses. See my tips and best picks on how to protect yourself from identity theft. 

5. Monitor your accounts: If you think you have been affected by the banking Trojan, regularly review your bank statements, credit card statements and other financial accounts for any unauthorized activity. If you notice any suspicious transactions, report them immediately to your bank or credit card company.

6. Enable SMS notifications for your bank accounts: By enabling SMS notifications, you can monitor your accounts for any unauthorized transactions.

Advertisement

7. Set up two-factor authentication (2FA): 2FA is an extra shield that prevents hackers from accessing your accounts.

8. Use a password manager: A password manager can help you create and store strong, unique passwords for all your accounts, reducing the risk of password theft.

9. Regularly update your device’s operating system and apps: Keeping your software up to date is crucial, as updates often include security patches for newly discovered vulnerabilities that could be exploited by Trojans.

10. Be wary of granting permissions: Carefully review the permissions requested by apps. If an app asks for more access than it needs for its functionality, it could be a red flag.

HOW TO REMOVE YOUR PRIVATE DATA FROM THE INTERNET

Advertisement

Kurt’s key takeaways

Hackers behind Medusa have made the malware hard to detect. They use apps that look legitimate to get the malware onto your phone and steal your personal data and sometimes your money. As a rule of thumb, only download apps from the Google Play Store. Google ensures it only allows secure apps on its platform and is safer than any other app store.

What are your thoughts on the increasing sophistication of mobile malware like the Medusa Trojan, and how do you think the cybersecurity industry should respond? Let us know by writing us at Cyberguy.com/Contact

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter

Ask Kurt a question or let us know what stories you’d like us to cover.

Follow Kurt on his social channels:

Advertisement

Answers to the most-asked CyberGuy questions:

Copyright 2024 CyberGuy.com. All rights reserved.

Advertisement
Continue Reading
Advertisement
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Technology

Ben Horowitz says he’ll donate to Kamala Harris after all

Published

on

Ben Horowitz says he’ll donate to Kamala Harris after all

“As I mentioned before, Felicia and I have known Vice President Harris for over 10 years and she has been a great friend to both of us during that time,” Horowitz wrote in an email to his venture capital firm obtained by Axios. “As a result of our friendship, Felicia and I will be making a significant donation to entities who support the Harris Walz campaign.”

Like, how do you walk that back?”

I… listen. Two things. First, one of the most striking things about the podcast Horowitz made with his a16z co-founder Marc Andreessen was how focused both men were on who’d take their meetings. Their political commitments, in many respects, boiled down to who would spend face time with them. Near the end of the podcast, Horowitz told what was (I think?) supposed to be a heartwarming story about hanging out with Trump’s grandkids — and how his reaction to hearing about the assassination attempt on Trump was, “Oh my god, Grandpa just got shot.”

So, you know, the whole thing where Harris has been “a great friend” to both Horowitz and his wife checks out as a political position for him. In some respects, I get it. I, too, want to see my friends succeed!

But second, that crucial Trump endorsement was made before Joe Biden dropped out of the presidential race in favor of Harris, and before the enormous outpouring of support for the new Democratic candidate. That meant a16z had already sacrificed any leverage it might have with a Harris administration — and a candidate who made Trump look like less of a sure winner. In the case of a Harris win, these boys were looking at an entire four years without important meetings, and we already know they view that as a dreadful tragedy for the entire nation.

Advertisement

In order to regain any possibility of leverage in a potentially Democrat-led government, someone was going to have to eat humble pie, and it sure as shit wasn’t going to be Andreessen. Horowitz, whose support for Trump was termed a “Maga U-turn” by The San Francisco Standard, has a history of donating to progressive causes; Harris, then a senator, was even a guest at a Horowitz backyard barbecue in 2018.

“I’m just wondering what they’re gonna do when Kamala wins,” one founder told The San Francisco Standard of the a16z Trump endorsement. “Like, how do you walk that back?”

Well, I guess we know now. Horowitz’s email says that he’s had several conversations with Harris and her team — crucial to note here that he got to the candidate herself, given that access is apparently one of Horowitz’s main political concerns. And so while Horowitz still thinks President Joe Biden is no-good and very bad, he is “encouraged by my belief” in Harris to do good for tech, despite the fact that she has not yet staked out any policy positions.

Harris has sort of made overtures on what Horowitz termed “probably the most emotional topic” in the election: crypto. One of her campaign aides has said, “She’s going to support policies that ensure that emerging technologies and that sort of industry can continue to grow,” in response to a question about crypto.

Advertisement
Continue Reading

Technology

10 tech tips and tricks everyone should know

Published

on

10 tech tips and tricks everyone should know

I’m using the new Apple iPhone 16 Pro Max with iOS 18.1. For some reason, Siri responds about 60% of the time when I ask it to call or text someone. Yes, this garbage even happens to me, and I’ve been helping folks with their tech lives for decades. 

That’s why I’ve channeled my frustrations into easy ways to make your tech less annoying, too.

THE $40K SCAM THAT ALMOST GOT ME + 3 MORE SPREADING NOW

Speaking of new iPhones … I’m giving away an iPhone 16 Pro with Apple Intelligence! No purchase necessary to enter.

Let’s start with Alexa: Amazon Echo smart speakers repeat what you just said, but you can turn off that default setting with just a few clicks. Open your Alexa app, tap More > Settings > Voice Responses, then turn on Brief Mode. Ah, short, sweet and to the point.

Advertisement

The new iPhone 16 Pro and iPhone 16 Pro max on display inside Omotesando Apple store.  (Stanislav Kogiku/SOPA Images/LightRocket via Getty Images)

Stop apps asking for ratings: Don’t want to be nagged to leave a rating for an app? On an iPhone, tap Settings > App Store and toggle off In-App Ratings and Reviews. There’s no fix for Android, unfortunately. Hey, Google, fix that!

You’re drowning in tabs: Here’s a faster way to navigate when you have lots of tabs open. Hit Ctrl + 1, 2, 3 and so on to go to that tab number. On Mac, it’s Command + a number. To cycle through tabs, hit Ctrl + Tab on Windows or Cmd + Tab on Mac.

3 SECURITY AND DATA CHECKS YOU SHOULD DO ONCE A YEAR

What the heck is that? Music blaring unexpectedly from a browser tab is no fun, especially when you can’t turn it off right away. Most browsers let you deal with this pretty easily now. In Chrome, for instance, simply right-click on the tab header and click Mute site.

Advertisement

Quick text search: You know you sent someone a pic but can’t find it. On iPhone, open Messages, tap a convo, then the person’s profile photo or group name. Scroll to Photos > See All. On Android, open Messages, then tap the search bar at the top.

A man holds an iPhone

Close up detail of a man holding a smartphone over a kitchen counter, taken on January 31, 2019.  (Neil Godwin/Future via Getty Images)

Fix the ducking autocorrect: This is one reason I rely on voice texting so much. When you type, autocorrect can keep changing the word you meant to write. Adding custom words that don’t get corrected helps. On an Android, head to Settings and choose System > Keyboard > Personal dictionary. From iOS, it’s under Settings > General > Keyboard > Text Replacement.

Printer out of black ink? Change the color to #010101. It’ll look black, but it’s really 99% gray. While you’re at it, knock down the font size and switch to Courier New or Garamond. They use the least ink. Bonus: If the prints are just for you, look for draft mode in your document settings.

20 TECH TRICKS TO MAKE LIFE BETTER, SAFER OR EASIER

30-second cleanup: If your phone’s home screen is a hot mess, folders to the rescue! Use a finger or stylus to drag one app on top of another to make a new folder. I like doing this to create folders by category (think one for social media apps, another for shopping apps and so on).

Advertisement

Undo drastic changes: Ever spent hours typing something and then — poof! — it all just vanishes on you? Simply hit “Undo” and it should come back. Press Ctrl + Z on Windows or Cmd + Z on a Mac. Ahhhh, there it is.

man working at desk

A man eats a slice of pizza while using a laptop. (iStock)

Desktop alerts: Notification overload is too much for my brain when I need to focus. Turn them off in Windows via Settings > System > Notifications. In macOS, it’s under your System Systems > Notifications.

Shhh: You can instantly silence incoming calls on your smartphone by pressing the side button, volume up or volume down button once. Nice.

Get tech-smarter on your schedule

Advertisement

Award-winning host Kim Komando is your secret weapon for navigating tech.

Copyright 2024, WestStar Multimedia Entertainment. All rights reserved. 

Continue Reading

Technology

Matt Mullenweg: ‘WordPress.org just belongs to me’

Published

on

Matt Mullenweg: ‘WordPress.org just belongs to me’

Over the past several weeks, WordPress cofounder Matt Mullenweg has made one thing exceedingly clear: he’s in charge of WordPress’ future.

Mullenweg heads up WordPress.com and its parent company, Automattic. He owns the WordPress.org project, and he even leads the nonprofit foundation that controls the WordPress trademark. To the outside observer, these might appear to be independent organizations, all separately designed around the WordPress open-source project. But as he wages a battle against WP Engine, a third-party WordPress hosting service, Mullenweg has muddied the boundaries between three essential entities that lead a sprawling ecosystem powering almost half of the web.

To Mullenweg, that’s all fine — as long as it supports the health of WordPress long-term.

“WordPress.org just belongs to me personally,” Mullenweg said during an interview with The Verge. WordPress.org exists outside the commercial realm of Automattic, as a standalone publishing platform that offers free access to its open-source code that people can use to create their own websites. But it’s not a neutral, independent arbiter of the ecosystem. “In my role as owning WordPress.org, I don’t want to promote a company, which is A: legally threatening me and B: using the WordPress trademark. That’s part of why we cut off access from the servers.”

“That’s true: we are pressuring them”

Advertisement

Mullenweg’s feud with WP Engine fans out in a few different directions. He’s criticized WP Engine for not putting enough time and money into developing the open-source WordPress ecosystem, saying that if you gave $1 to the WordPress Foundation, “you’d be a bigger donor than WP Engine.” And Mullenweg has brought up the possibility that WP Engine “hacked” the Automatic-owned WooCommerce plug-in to collect commissions meant for Automattic, which WP Engine has denied. From those arguments, the fight appears to be one over what is and isn’t appropriate in the open-source software world.

But Mullenweg has since sidelined those arguments to make the case that WP Engine — and its “hacked up, bastardized simulacra” of the WordPress open-source code, as he describes it — is infringing on Automattic’s trademark: WordPress.

“The analogy I made is they got Al Capone for taxes,” Mullenweg says. “So, if a company was making half a billion dollars from WordPress and contributing back about $100,000 a year, yes, I would be trying to get them to contribute more.” WP Engine competes directly with the hosting services offered by Automattic and WordPress.com, and Mullenweg argues one of the reasons for its success is the use of “WordPress” across its site. “That’s why we’re using that legal avenue to really, yeah, pressure them. That’s true: we are pressuring them.”

Mullenweg began his public pressure campaign during a WordPress conference last month, telling people to “vote with your wallet” and stop supporting WP Engine. He later called the service a “cancer” to the WordPress ecosystem. Mullenweg eventually blocked WP Engine from WordPress.org’s servers, leaving WP Engine’s customers unable to install themes, plug-ins, and updates.

The decision to cut off WP Engine also put other WordPress projects in a precarious position. WordPress is open-source and free to use, with no mandate to give back. But Mullenweg has made it clear that there is some bar that successful projects must meet to stay off Automattic’s radar.

Advertisement

“I happily provide WordPress.org services to literally every other host,” Mullenweg says. There is “no requirement to give back. WordPress will be open-source forever and ever, and so there will never be any legal requirement to give back.” But WordPress does still “request” that companies contribute something. “It’s better for WordPress if they give back.”

For WP Engine, what it comes down to is this: Mullenweg wants the company to contribute to WordPress, whether it’s by paying to license the WordPress trademark or by pitching into the open-source WordPress project.

Even though the WordPress Foundation controls the platform’s trademark, the commercial rights for that trademark are licensed to Automattic. That means Automattic can charge other companies for using the WordPress trademark for commercial purposes — and that’s where Mullenweg has been able to exert pressure on WP Engine.

“What they’re doing is not okay. It’s not that they’re calling it WP; it’s that they’re using the WordPress trademark in confusing ways,” Mullenweg said. He cited the “frantic changes” he claims WP Engine made to its site to remove mentions of “WordPress” after the dispute began. Under the WordPress Foundation’s trademark policies, companies can use the WordPress name and logo to “refer to and explain their services.”

The foundation says the “WP” abbreviation isn’t covered by its trademarks, but the guidelines were recently tweaked to say that companies should stop using the abbreviation in “a way that confuses people.” During The Verge’s interview, Mullenweg confirmed he changed the foundation’s trademark policies to include a “dig at WP Engine.” The policy now says WP Engine “never once even donated to the WordPress Foundation, despite making billions of revenue on top of WordPress.”

Advertisement

This week, Automattic published its proposed solution to the dispute: a seven-year deal that would require WP Engine to pay an 8 percent fee on all revenue to either use the WordPress and Automattic’s WooCommerce trademarks or to compensate employees who would contribute to the WordPress open-source project. The deal was offered in late September, but Mullenweg says it’s off the table due to “WP Engine’s behavior, deception, and incompetence.”

The dispute culminated in a lawsuit, in which WP Engine accuses Automattic and Mullenweg of extortion. WP Engine alleges that Mullenweg said he would proceed with a “scorched earth nuclear approach” after the two failed to come to an agreement. “When WPE refused to capitulate to Automattic’s astronomical and extortionate monetary demands, Mullenweg made good on his threats,” WP Engine claims. “The threat of ‘war’ turned into a multi-front attack, part of an overarching scheme to extract payouts from WPE.”

In the lawsuit, WP Engine claims Mullenweg is attempting to “capitalize on the chaos he caused” by advertising a deal to switch to Pressable — another WordPress host owned by Automattic. The filing also includes a purported job offer from Mullenweg to WP Engine CEO Heather Brunner saying that if she declines to join Automattic, he’d tell the CEO of Silver Lake — the private equity firm that owns WP Engine.

WordPress executive director Josepha Haden Chomphosy has since left Automattic, along with more than 150 other employees who accepted Mullenweg’s offer to leave for $30,000 or six months of pay, whichever is higher, if they didn’t support his fight against WP Engine.

More importantly, WP Engine’s lawsuit raises concerns about corporate overreach, alleging Mullenweg’s actions reflect “a clear abuse of his conflicting roles” at the WordPress Foundation, Automattic, and the open-source WordPress project. In a statement on Thursday, Automattic called the lawsuit “baseless,” adding that it denies WP Engine’s allegations, “which are gross mischaracterizations of reality.”

Advertisement

However the legal case may pan out, it’s become clear that Mullenweg does control WordPress.org. But his fight with WP Engine has only made the border between WordPress and Automattic murkier, casting a shadow of uncertainty over the open source community that’s long backed him. That seems to be a risk Automattic is willing to take as long as WordPress comes out on top.

Continue Reading

Trending