American Banks Targeted by Xenomorph Android Malware

The notorious Android banking Trojan, Xenomorph, has widened its attack spectrum to target customers of over two dozen major US and Canadian banks and several cryptocurrency wallets, including Bitcoin, Binance, and Coinbase. According to BleepingComputer, the trojan initially emerged in early 2022, with its primary targets being European banks in Spain, Italy, Portugal, and Belgium.

However, the malware can now target customers of major US financial institutions such as Chase, Amex, Ally, Citi Mobile, Citizens Bank, Bank of America, and Discover Mobile. Developed by the Hadoken Security Group, Xenomorph has undergone several enhancements over time, with the most recent version (released in March 2023) featuring an automated transfer system, MFA bypass, cookie stealing, and the capability to target over 400 banks worldwide.

As highlighted by DarkReading, the malware was initially distributed through Google Play via malicious apps. One of these, a supposed optimization tool named Fast Cleaner, was downloaded over 50,000 times. In this latest campaign, the threat actors now distribute Xenomorph malware via phishing pages. These pages, often impersonating Chrome updates or Google Play store websites, deliver a malicious APK to unsuspecting users.

Thousands of Android users, particularly those using Samsung and Xiaomi devices, have fallen victim to Xenomorph. The malware exhibits advanced features such as the ability to mimic other applications, simulate taps at specific screen coordinates, perform overlay attacks, and automatically complete fraudulent transactions. A particularly alarming feature is its ability to extract SMS authenticator codes.

Analysts at ThreatFabric have been closely tracking Xenomorph's activity and have uncovered additional malicious payloads on the distribution server. This discovery suggests the possibility of collaboration between different threat actors or the potential scenario of Xenomorph being offered as a Malware-as-a-Service (MaaS).

"The fact that we saw Xenomorph being distributed side-by-side with powerful desktop stealers is very interesting news. It could indicate a connection between the threat actors behind each of these malware, or it could mean that Xenomorph is being officially sold as a MaaS to actors, who operate it together with other malware families. In each case, it indicates an activity from Xenomorph which we have not seen before, but which we might see a lot of in the near future." stated ThreatFabric.