Beware: Malicious Apps Are Stealing Bank Credentials on iOS and Android Through New Phishing Technique
A new wave of phishing attacks has emerged, putting iOS and Android users at significant risk. ESET, a security firm, has sounded the alarm on a sophisticated phishing tactic that bypasses standard security measures, potentially compromising the bank credentials of countless users.
Cybercriminals have developed a deceptive strategy that utilizes Progressive Web Applications (PWAs) and WebAPKs—web-based applications designed to mimic legitimate banking software. These malicious apps are designed to look and function like genuine mobile banking apps, but their true purpose is to steal your sensitive information.
On iOS devices, users are being tricked into adding PWAs to their home screens, believing them to be trusted applications. Android users face an even more insidious threat: WebAPKs. These applications can masquerade as native apps, appearing to be downloaded from Google Play without triggering any of the usual security warnings. Shockingly, even if a user has not permitted the installation of third-party apps, these WebAPKs can still bypass those settings, further obscuring their malicious intent.
Once installed, these fraudulent apps prompt users to enter their banking credentials under the guise of accessing their accounts. Every piece of information entered is immediately sent to the attackers’ command-and-control (C&C) servers, giving cybercriminals unfettered access to victims’ bank accounts.
The attacks, which reportedly began in late 2023, have already targeted mobile banking users in the Czech Republic, Hungary, and Georgia. However, the potential for this phishing tactic to spread globally is real and alarming. ESET warns that the attackers are likely to develop more copycat applications, making it increasingly difficult for users to distinguish between legitimate and fraudulent apps.
This evolving threat serves as a stark reminder to be vigilant and cautious. If you receive any prompts to install or update a banking app, verify its authenticity through official channels. Your financial security may depend on it.
