2024.07.04. The Fair Economy — Anatsa, an Android-based malicious app also known as TeaBot that began financial information theft attacks on European financial apps in early 2021, has been confirmed to now be targeting Korea as well. Financial consumers need to be especially careful to avoid falling victim.
The Financial Security Institute said on the 4th that it discovered that Anatsa, which disguises itself as PDF readers, QR code scanners, and other legitimate apps and is distributed through Google Play, has recently expanded its attack scope to target domestic financial institutions, and immediately shared this information with financial companies and antivirus vendors.
The malicious app has expanded its targets every year, and according to the Financial Security Institute's analysis, as of June 2024, 688 apps in the financial, fintech, and cryptocurrency sectors across 54 countries, including Korea, were identified as targets for financial information theft.
When a disguised app registered on the Google Play Store, pretending to be a legitimate service such as a PDF reader or QR code scanner, is installed on a smartphone, the Anatsa malicious app is downloaded from a distribution server and installed under the guise of an app update.
The Anatsa malicious app, under the command of a C&C (Command & Control) server that can remotely control the smartphone, steals data such as screenshots, text messages, and authentication codes, and performs controls such as unlocking the smartphone screen, touching the screen, and entering values. The stolen data is transmitted to the C&C server.
The malicious app particularly steals personal financial information through keylogging attacks that intercept user input in real time, or overlay attacks that display fake similar screens to capture information entered by users.
It also interferes with the execution of mobile antivirus and cleaner apps, and blocks smartphone shutdown or access to settings menus, preventing the malicious app from being terminated or deleted.
Until now, similar malicious apps were mainly distributed overseas, but it is expected that they will continue to flow into Korea, led by Anatsa.
Kim Cheol-ung, head of the Financial Security Institute, said, "With the digital transformation of finance and the activation of non-face-to-face financial transactions, malicious apps targeting financial apps have increased significantly. Given that these malicious apps are also distributed through official app stores, financial consumers need to be especially cautious."
0 Comments
No comments yet.