We review vendors based on rigorous testing and research but also take into account your feedback and our affiliate commission with providers. Some providers are owned by our parent company.
Learn more
vpnMentor was established in 2014 as an independent site reviewing VPN services and covering privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize the independent, professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.
Advertising Disclosure

vpnMentor was established in 2014 as an independent site reviewing VPN services and covering privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize the independent, professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.

American Banks Targeted by Xenomorph Android Malware

American Banks Targeted by Xenomorph Android Malware
Husain Parvez Published on 28th September 2023 Cybersecurity Researcher

The notorious Android banking Trojan, Xenomorph, has widened its attack spectrum to target customers of over two dozen major US and Canadian banks and several cryptocurrency wallets, including Bitcoin, Binance, and Coinbase. According to BleepingComputer, the trojan initially emerged in early 2022, with its primary targets being European banks in Spain, Italy, Portugal, and Belgium.

However, the malware can now target customers of major US financial institutions such as Chase, Amex, Ally, Citi Mobile, Citizens Bank, Bank of America, and Discover Mobile. Developed by the Hadoken Security Group, Xenomorph has undergone several enhancements over time, with the most recent version (released in March 2023) featuring an automated transfer system, MFA bypass, cookie stealing, and the capability to target over 400 banks worldwide.

As highlighted by DarkReading, the malware was initially distributed through Google Play via malicious apps. One of these, a supposed optimization tool named Fast Cleaner, was downloaded over 50,000 times. In this latest campaign, the threat actors now distribute Xenomorph malware via phishing pages. These pages, often impersonating Chrome updates or Google Play store websites, deliver a malicious APK to unsuspecting users.

Thousands of Android users, particularly those using Samsung and Xiaomi devices, have fallen victim to Xenomorph. The malware exhibits advanced features such as the ability to mimic other applications, simulate taps at specific screen coordinates, perform overlay attacks, and automatically complete fraudulent transactions. A particularly alarming feature is its ability to extract SMS authenticator codes.

Analysts at ThreatFabric have been closely tracking Xenomorph's activity and have uncovered additional malicious payloads on the distribution server. This discovery suggests the possibility of collaboration between different threat actors or the potential scenario of Xenomorph being offered as a Malware-as-a-Service (MaaS).

"The fact that we saw Xenomorph being distributed side-by-side with powerful desktop stealers is very interesting news. It could indicate a connection between the threat actors behind each of these malware, or it could mean that Xenomorph is being officially sold as a MaaS to actors, who operate it together with other malware families. In each case, it indicates an activity from Xenomorph which we have not seen before, but which we might see a lot of in the near future." stated ThreatFabric.

About the Author

Husain Parvez is a Cybersecurity Researcher and News Writer at vpnMentor, focusing on VPN reviews, detailed how-to guides, and hands-on tutorials. Husain is also a part of the vpnMentor Cybersecurity News bulletin and loves covering the latest events in cyberspace and data privacy.