Mobile banking Trojan ‘Faketoken’ targeting Uber users
A new modification of notorious mobile banking Trojan “Faketoken” has resurfaced which is able to steal credentials from popular taxi applications and ride-sharing apps, Moscow-based cybersecurity firm Kaspersky Lab said on Friday.
“The new version of ‘Faketoken’ performs live tracking of apps and, when the user runs a specified app, overlays this with its phishing window to steal the bank card details of the victim,” Kaspersky Lab said in a statement.
The trojan virus has an identical interface, with the same colour schemes and logos, which creates an instant and completely invisible overlay.
According to Kaspersky Lab, the new version of “Faketoken” targets mostly Russian users but they believe the geography of attacks could easily be extended in the future.
The “Faketoken” modification steals all incoming SMS messages by redirecting them to its command and control servers, allowing criminals to get access to one-time verification passwords sent by a bank, or other messages sent by taxi and ride-sharing services.
Among other things, the malware also monitor users’ calls, records them and transmits the data to the command and control servers.
Kaspersky researchers have also detected ‘Faketoken’ attacks on other popular mobile applications, such as travel and hotel booking apps, apps for traffic fine payments, Android Pay and the Google Play Market.
