On April 21st our WildFire analysis cloud detected a new Android Trojan, which is currently completely undetected in VirusTotal and uses a new combination of tactics to make money for the author. Based on the state of the code and the limited distribution we believe we may have detected this malware during a testing phase, before the attacker released it into the wild through an app store or other means. We’ve named the Trojan Cardbuyer because of the way it converts an infection into cash for the author.
Cardbuyer is much “smarter” compared to the existing Android malware families that we have ever seen. Specifically, this malware sample can solve CAPTCHA challenges, emulate user’s behaviors, parse SMS’s content from different vendors, and then automatically reply the confirmation message accordingly. Code analysis shows that this malware sample can defeat the existing multi-factor verification procedures of many popular game platforms or online payment systems, and impersonate the smartphone user in making the purchase.
Get updates from Unit 42 