Malware Alert For Android Users! Trojan Masked As I-T Refund Attacks Customers Of 27 Indian Banks

The new malware is impersonating as an "income tax refund" that can "effectively jeopardise the privacy of sensitive customer data and result in large-scale attacks and financial frauds".

A Trojan malware has been detected which is attacking Indian bank customers who are using Android phones. The malware has already attacked customers from 27 public and private sector banks. The Indian Computer Emergency Response Team or CERT-In, said in its latest advisory. 

Malware is basically software that is designed to damage a computer system. The new malware is impersonating as an "income tax refund" that can "effectively jeopardise the privacy of sensitive customer data and result in large-scale attacks and financial frauds", the CERT-In said on Tuesday. 

The CERT-In said that the customers are being targeted by Drinik android malware. "Drinik started as a primitive SMS stealer back in year 2016 and has evolved recently to a banking Trojan that demonstrates phishing screen and persuades users to enter sensitive banking information," it said to PTI. 

The CERT-In is the federal technology arm to prevent cyber attacks and guard Indian cyberspace against malware, hacking assaults, and similar online attacks. The CERT-In advisory describes the process of the attack and how the customers can be saved. 

The victim first receives an SMS with a link to download the malicious APK file in order to complete verification. They are asked to enter their personal information. This website is similar to the website of the Income Tax Department.

"This malicious android app masquerades as the Income Tax Department app and after installation, the app asks the user to grant necessary permissions like SMS, call logs, contacts etc," said the CERT-In advisory. "If the user does not enter any information on the website, the same screen with the form is displayed in the android application and the user is asked to fill in to proceed," it added.

The required data to be entered includes PAN, Aadhaar number, address, date of birth, mobile number, email address, IFSC Code, Debit card number and CVV, etc. 

When the user enters the amount and clicks "Transfer", the app displays an error demonstrating a fake update screen.

"While the screen for installing the update is shown, Trojan in the backend sends the user's details including SMS and call logs to the attacker's machine," it said.

"These details are then used by the attacker to generate the bank specific mobile banking screen and render it on user's machine. The user is then requested to enter the mobile banking credentials which are captured by the attacker," it added.

The CERT-In has asked users to immediately report any unusual activity in their account to their bank. Users can also send a complaint to CERT-In at incident@cert-in.org.in.