Malware
Ajina.Banker Android Malware Targets Central Asia: Steals Banking Credentials and 2FA Messages
In May 2024, Group‑IB uncovered Ajina.Banker, an Android banking trojan that masquerades as legitimate apps to harvest credentials and intercept 2‑factor SMS. The malware has been active across Central Asia, compromising users of popular banking apps. Defenders should verify app provenance, enforce app whitelisting, and monitor for anomalous SMS traffic.
In May 2024, Group‑IB identified Ajina.Banker, an Android malware that disguises itself as legitimate applications to harvest banking credentials and intercept 2‑factor authentication SMS.
What happened
Ajina.Banker is distributed via compromised or malicious app stores in Central Asia. Once installed, it captures login details from banking apps and redirects 2FA SMS to the attacker’s server.
Impact
- Compromised banking accounts in Uzbekistan, Kyrgyzstan, Tajikistan, and surrounding countries.
- Loss of sensitive personal data and potential financial theft.
- Disruption of trust in mobile banking ecosystems.
What to do
Defenders should:
- Verify the digital signature of banking apps before installation.
- Implement app whitelisting and restrict sideloading on corporate devices.
- Monitor outbound SMS traffic for patterns of 2FA interception.
- Educate users to report suspicious app behavior.
Mitigation
Deploy mobile threat defense solutions that detect credential‑stealing behavior and block SMS‑based 2FA hijacking. Keep Android OS and banking apps up to date, and enforce the use of authenticator apps instead of SMS where possible.
Related articles
Hirudo Android Trojan Replaces Banking Apps with Patched Versions to Evade Security Checks
A new Android banking trojan, Hirudo, replaces legitimate banking apps with custom patched copies that bypass in‑app integrity and signature checks. The malware, delivered via popular dropper apps, steals credentials, takes device control, and captures screens, cameras, and SMS. Defenders should audit banking app integrity, block suspicious in‑app updates, and monitor for unauthorized accessibility services.
Read briefing
Godfather Trojan Targets Mobile Banking Apps – Immediate Mitigation Steps
Group‑IB uncovered the Godfather banking Trojan infecting users of 400+ mobile financial apps in 16 countries. The malware steals credentials and forces unauthorized transfers. Defenders must update apps, enforce MFA, and monitor transactions.
Read briefing
Hirudo Android Malware Hijacks Banking Apps to Steal Credentials
Hirudo is an Android malware that replaces legitimate banking apps with malicious copies, disabling security checks to harvest credentials and remotely control devices. It targets banks in Indonesia, China, India, Mexico, Morocco, and Thailand, and is delivered via apps that masquerade as shopping or entertainment services. Defenders should verify app signatures, enforce Play Integrity, restrict Accessibility permissions, and deploy mobile security solutions to detect hooking engines.
Read briefing
RemControl Android Banking Malware Targets European and Canadian Users via Fake IPTV Ads
RemControl, a new Android malware‑as‑a‑service platform, has been delivering banking trojans through fake TVTap IPTV ad sites. The campaign, active since May, targets users in Italy, France, Spain, Poland, Portugal, Canada and the Middle East. Defenders should block known malicious domains, enforce app‑store vetting, and monitor for phishing overlays on Android devices.
Read briefing