In summary:
- PCWorld reports that cybercriminals are distributing ‘Massiv’ malware through fake IPTV streaming apps that appear functional but primarily serve to steal banking credentials.
- This Android malware can bypass banking app security, remotely control devices, and uses keylogging to capture passwords and financial information for identity theft.
- ThreatFabric researchers found the threat mainly targets European users, particularly in Portugal, with attackers using stolen identities to open fraudulent accounts for money laundering.
A new Android malware called “Massiv” is on the rise. Security researchers at ThreatFabric uncovered the large-scale campaign, in which hackers disguised and distributed the malware as a harmless IPTV streaming app. Once installed, however, the app was able to read screen inputs to steal passwords and bank details.
The malware is classified as highly dangerous and uses screen overlays and keylogging to obtain sensitive data. It can even bypass the usual protection mechanisms of banking apps, which are designed to guard against the capture of on-screen content.
According to the researchers, the malware can even be used to remotely control compromised devices. In some of the cases investigated, the attackers also stole users’ identities and were even able to open new financial accounts in their names—and it’s suspected that said accounts are being used for money laundering.
IPTV streaming apps as bait
In its report, ThreatFabric addresses a current trend of hiding malware and other malicious software behind IPTV apps. Over the past 8 months, hackers have increasingly used such streaming apps as bait.
Note that IPTV offerings come in both legal and illegal flavors. The legal ones can be found in official stores such as the Google Play Store, while the illegal ones are mainly offered via third-party sites and may violate copyright laws. In the case of Massiv malware, the offered apps are useless—they can’t be used for either legal or illegal streaming.
To ensure that the app remains active long enough to download malware in the background, the attackers use copies of genuine IPTV websites to distract users. Most of the cases investigated originate in Europe, with users in Portugal being the main target of Massiv… so far.
How to protect yourself
Only download verified apps from reputable providers that are available in official app stores such as the Google Play Store. Activate Google Play Protect. Never grant unnecessary permissions to newly installed apps. Install a reputable antivirus app for additional protection.
Further reading: This Android security app is actually malware
This article originally appeared on our sister publication PC-WELT and was translated and localized from German.
Author: Laura Pippig, Staff Writer, PC-WELT
Laura is an enthusiastic gamer as well as a movie and TV fan. After studying communication science, she went straight into a job at PCMagazin and Connect Living. Since then, she has been writing about everything to do with PCs and technology topics, and has been a permanent editor at our German sister site PC-WELT since May 2024.