Clicking This Fake Chrome Update Could Drain Your Bank Account and Leak Your Location

Clicking This Fake Chrome Update Could Drain Your Bank Account and Leak Your Location

Security threat firm ThreatFabric has released details about a new Android-based banking malware called Brokewell. The name refers to the malware's ability to drain bank accounts, but it can do so much more.

The program is said to be in active deployment as of this article's writing, and currently masquerades as an update for Google Chrome on Android, even going so far as to very closely mimic the actual ads Google puts out for its browser.

ThreatFabric warns that Brokewell is equipped with both remote-control capabilities and data-stealing functionality. All of that is built right into the malware rather than relying on a cloud connection, making it especially detrimental to your device's security. Like many other recent Android malware families, Brokewell is also capable of getting around the Google-imposed restrictions meant to keep sideloaded applications from requesting permissions to accessibility services.

Comparison of fake ad that installs Brokewell versus a real Chrome ad
A comparison of a real Google Chrome ad and the fake ad that installs Brokewell on your Android device. Credit: ThreatFabric

Once installed and launched for the first time, Brokewell prompts the infected user to grant permissions for accessibility services. The malware can then automatically grant itself other permissions, giving it open access to carry out a slew of malicious activities, ThreatFabric warns.

So far, Brokewell has been spotted masquerading as three popular applications: Google Chrome, ID Austria, and Klarna. The security firm also warns Brokewell is constantly logging information from all of your apps, making it especially dangerous: It isn't just your banking that's at risk, as the malware can also collect information such as call history, geolocation, and recorded audio.

The rise of malware apps like Brokewell does not bode well for the future of Android threats. With more and more bad actors gaining the ability to bypass the restrictions put into place in Android 13, Google will need to find new ways to protect users. Of course, users themselves will also need to be mindful of what they are downloading and sideloading.

Either way, if you're running an Android phone right now, be careful what you download, and only download applications from trusted sources. Importantly, if a third-party app asks for accessibility permissions, don't give them to it, as it could provide open access to your device and any data stored on it.



* This article was originally published here

Comments

Post a Comment

Popular posts from this blog

How to Download All Your Media From Google Photos

Image
Cloud storage has changed the way we take care of our data. In the past, you needed to backup and transfer files between devices directly, or else you wouldn't have them in multiple locations. If you took photos on your iPhone or Android, for example, you'd often want to plug it into your computer to make sure those photos were both backed up and easily accessible for sharing with friends, family, and the internet at large. The problem is, we've changed the way we deal with data these days. If you plug your smartphone into your computer expecting to transfer all the photos and videos you see in your photos app of choice, you might be surprised to find that only a fraction of the images actually make their way to your PC. It's confusing, considering that media is accessible on the phone: Why can it just be a seamless transfer? Google Photos makes it confusing to know which images are stored on-device That's exactly what happened with Reddit user Spax123 , who took
Read more

The Best U.S. Cities for Tech Jobs (Aside From the Obvious)

Image
Working in tech no longer means having to live in one of a handful of increasingly unaffordable cities, like New York City, Seattle, Chicago, and San Francisco. Instead, as jobs involving artificial intelligence and product security, among other areas, continue to grow, cities that weren't previously considered tech hubs now offer opportunities for both tech-related employment and affordable living. Here are a few examples, compiled using data from job market reports and cities, as well as input from tech recruiters and hiring managers. Bentonville, Arkansas Perhaps best known for being Walmart's home city, Bentonville has been on the rise as a tech center for the last seven or eight years, according to Eóin O'Toole, a tech recruiter and managing partner at Riviera Partners . In addition to the big-box store giant, O'Toole says that there's a "surging ecosystem both directly and indirectly related to Walmart," as well as other major employers, like JB H
Read more

How to Choose Between Alexa and Google Assistant

Image
If you’re looking to have a hands-free experience with your smart home, you need a voice assistant. By merely talking in the direction of a device enabled with the assistant, you can get information about the weather, time, local businesses, or anything else from their knowledgbase. You can control smart devices or send an email or SMS, and it’s all done by interacting vocally with the assistant, who speaks in a human-ish way. There are three well-known voice assistants: Siri, which is exclusive to Apple devices, Alexa , which is operated by Amazon, and Google Assistant . Since people are generally Apple or Android loyalists , it makes sense that if you run Apple products, you’d stick with Siri for your assistant. For everyone else, which voice assistant should you choose: Alexa or Google?  When it comes to smart home technology, there are two factors to consider: the hub you’ll use to connect your smart devices so you can control them, and what voice assistants you might want to use
Read more