Hacking News 150817-google-marshmallow-04-100608185-primary.idge

Published on January 14th, 2016 | 89 views Post Views

Android malware steals one-time passcodes

One-time passcodes, a crucial defense for online banking applications, are being intercepted by a malware program for Android, according to new research from Symantec.

The malware, called Android.Bankosy, has been updated to intercept the codes, which are part of so-called two-factor authentication systems.

Many online banking applications require a login and password plus a time-sensitive code in order to gain access. The one-time passcode is sent over SMS but also can be delivered via an automated phone call.


Some banks have moved to call-based delivery of passcodes. In theory, that provides better security since SMS messages can be intercepted by some malware, wrote Dinesh Venkatesan of Symantec in a blog post on Tuesday.

But Bankosy has been updated to forward all calls to the attackers, Venkatesan wrote. In the Asia-Pacific region, many operators use a service code in the format *21*[destination number]# to forward calls, which Bankosy has implemented.

The malware also “has support for disabling and enabling silent mode in addition to locking the device so that the victim is not alerted during an incoming call,” Venkatesan wrote.

The one-time passcode is used with the victim’s login credentials, which the attackers have presumably already obtained.


Symantec detected Bankosy in July 2014. A technical writeup from that time shows the malware also prompted victims to enter their payment card information in a more bold attempt at fraud.

Share on Facebook0Share on Google+0Tweet about this on TwitterShare on Reddit0Email this to someonePrint this pageShare on StumbleUpon0Digg thisPin on Pinterest0Share on LinkedIn0

Leave a Reply

Your email address will not be published. Required fields are marked *

Back to Top ↑

You Might Also Like:
Apple’s ‘Targeted’ Gatekeeper Bypass Patch Leaves OS X Users Exposed

Apple has had two cracks at patching a vulnerability that allows malicious apps to bypass its OS X Gatekeeper security...