A new Android banking trojan called SharkBot was found spreading through fake antivirus apps on the Google Play Store. Cleafy first found the malware at the end of October 2021. SharkBot was built to steal money from infected phones, while likely bypassing multi-factor authentication (MFA). Unlike TeaBot and Oscorp, which need a live operator to authorize transfers, SharkBot automates them.
In its March 2022 analysis, NCC Group found that SharkBot uses ATS (Automatic Transfer System) features to move money from compromised devices. ATS lets the malware fill in fields in real banking apps and start transfers by itself. It does this by simulating a user’s actions, such as taps and clicks. This helps the attackers get past the bank’s fraud checks.
The app on Google Play was a reduced version of SharkBot that acts as a dropper. Once installed, it uses ATS to download and install the full malware. It then spreads further by abusing Android’s “Direct Reply” feature to auto-reply to notifications with a link to the fake antivirus app.
If users grant Accessibility permissions, SharkBot can show fake login pages (phishing) to steal credentials. It can also record keystrokes and send the stolen data to its command-and-control (C&C) servers.
Check Point Research found six apps on Google Play that were spreading SharkBot. They came from three developer accounts, and Google removed all of them after the reports. The apps were:
- Antivirus, Super Cleaner
- Atom Clean-Booster, Antivirus
- Alpha Antivirus, Cleaner
- Powerful Cleaner, Antivirus
- Center Security – Antivirus (two apps with this name)
To lower the risk of infection with similar malware, keep the number of apps on your devices to a minimum. Check the permissions each new app asks for, and install apps only from trusted, verified publishers. Also make sure the security tools in use detect and block the known SharkBot indicators (IoCs).