Xenomorph Android Malware Campaign Targets US Banks

Android banking Trojan Xenomorph has resurfaced in a new campaign targeting cryptocurrency wallets and various financial institutions. The malware has been actively targeting users in Europe for more than a year and is now focused on institutions in the United States, Canada, Spain, Italy, Portugal and Belgium.

See Also: Live Webinar | Cyber Resilience: Recovering from a Ransomware Attack

Netherlands-based security research firm ThreatFabric, which first discovered Xenomorph in early 2022, in a found new samples of Xenomorph in August with updated features in an ongoing campaign that netted thousands of downloads in Spain and the United States.

Malware families have started expanding their target area across the Atlantic Ocean, including the most distributed malware-as-a-service families such as Octo, Hydra and Hook, and some of the most notorious privately operated families such as Anatsa, researchers said. Malware that offered “device takeover capabilities” made it easier than ever for criminals to move across different markets and perform fraud with little or no infrastructure needed.

The Xenomorph Trojan in 2022 targeted 56 European banks and is linked with the Alien Trojan family. It was detected in the Google Play Store with more than 50,000 malicious app installations (see: Cryptocurrency Wallets Targeted by Alien Malware Variant).

ThreatFabric researchers said the campaign’s distributing method involved phishing pages posing as a Chrome update.

Google Chrome browser or Google Play store updates are less likely to raise the suspicions of victims, who are extremely likely to have them already installed on their devices, researchers said.

The campaign is heavily focused on Spain, with over 3,000 downloads in a few weeks, followed by over 200 downloads in the United States and Portugal.

The malware also is distributing desktop stealers such as RisePro stealer, a popular credential stealer.

This could indicate a connection between the threat actors behind these malware types, or that Xenomorph is officially sold as a MaaS to threat actors, who operate with other malware families.

Xenomorph Trojan Enhancements

Xenomorph capabilities range from simple SMS manipulation to full device control due to an automated transfer system framework obtained through remote access capabilities provided by accessibility services privileges.

The framework enables the malware to perform many actions that can be used and chained into sequences of operations and triggered when specific conditions are met, researchers said.

Threat actors refer to a set of actions as “modules,” and the latest iteration of the malware contains a large set of modules that can manipulate infected device settings by granting write permission to the malware or disabling Doze mode, which conserves battery by restricting apps’ access to network and CPU-intensive services.

The malware uses overlays to obtain personally identifiable information such as usernames, passwords and credit card numbers that are transmitted to an attacker-controlled server.

These overlays also are encrypted using a combination of an algorithm specific to Xenomorph and AES. Once decrypted, the overlay poses as login pages for the targeted applications.

In the latest campaign observed by the researchers, the malware targeted numerous financial institutions in the United States, together with multiple crypto-wallet applications, totaling more than 100 different targets per sample analyzed. Every sample used a specifically crafted overlay to steal PII from the victim’s infected device.

The latest version of the malware also included multiple modules dedicated to precise actions for specific mobile user interfaces based on Android Open Source Projects, in the same way MIUI is used for Xiaomi or One UI for Samsung.

“This is necessary because different UIs require a unique order of operations to perform specific actions, like disabling Doze mode,” researchers said.

It also enables the threat actors using the Xenomorph malware to recreate the flow of a decision algorithm and perform conditional checks and loops, vastly increasing its flexibility.

Updated Features

• Anti-sleep Feature: This enables threat actors to keep the infected device from going into sleep mode. The malware maintains an active notification keeping the device awake and preventing it from going to sleep.
• ‘Mimic’ Feature: This enables threat actors to act as any other application and removes one behavior that is often associated with malware, making it look more legitimate. It also contains an activity called IDLEActivity, which is used as a webView to display a legitimate website.
• ClickOnPoint Feature: This gives threat actors the ability to simulate a simple touch at specified coordinates allowing them to perform small actions without having to create a full ATS module.