MITRE ATT&CK describes GodFather as Android banking malware, first identified in 2020, that abuses accessibility services and uses virtualization to mimic legitimate banking and cryptocurrency applications. Its virtualization-based attacks have primarily focused on Turkish financial institutions.
Godfather generates fake notifications that lure victims to phishing pages, and it can capture Google Authenticator one-time passwords through the accessibility service. When victims open a trusted banking app, it redirects them to a malicious version, and the credentials entered there are sent to command and control (C&C) servers.
Some activities that Godfather trojan software performs on infected systems;
- Recording the device’s screen
- Creating VNC connections
- Capturing keystrokes (keylogging)
- Leaking push notifications and SMS messages (to bypass 2FA)
- Send SMS messages
- Forward calls
- Execute USSD requests
- Start proxy servers
- Enabling silent mode
- Establishing WebSocket connections
MITRE ATT&CK notes that Godfather has imitated Google Play Protect, including its device scanning and its request for the accessibility service, and that it abuses the accessibility service to stop the user from uninstalling it. Considering these details, it is recommended to consider the following security recommendations to avoid being a victim of targeted attacks that the Godfather malware may carry out.
- Emails, attachments, and links from unknown parties should not be respected.
- Downloaded applications should be downloaded from legitimate application stores, and by checking the evaluations made,
- Comprehensive security solutions should be used.