There is an Alien looking to steal your Crypto!

And no, its not @acidyo or @derangedvisions from the OCD community, although them guys are weird, right? This is a new trojan is affecting Android users and the Coinbase, blockchain.com and luno wallets. The trojan is based on the Cerburus trojan from some years back. Google play store was almost free of infected apps, mainly because the group behind it pretty much deserted it when Google discoverd a way to track infected apps, but the trojan has seen new life in recent weeks after its been picked up by a new group and its spreading. There are 226 apps that are currently affected. This particular trojan has the ability to intercept 2fa codes and passwords in transit. This is a dangerous trojan. I would strongly advise anyone using an android device to keep your eyes peeled and uninstall any unused or questionable apps from your devices.

This first came to my attention a couple of weeks ago when @hetty-rowan hit me up on discord to say she had a lot of weird things happening in her coinbase wallet. Her account had been compromised and she had 2fa enabled. The attacker was able to convert some of her coins to BTC but thankfully they were unable to withdraw the funds from her account as she had the email feature also enabled.

FYI: Hetty does not know the answer to your questions!! There are apps listed below, read the list and if you have an affected app, remove it.

Currently, according to ThreatFabric, Alien boasts the following capabilities:

• Can overlay content on top of other apps (feature used for phishing login credentials)
• Log keyboard input
• Provide remote access to a device after installing a TeamViewer instance
• Harvest, send, or forward SMS messages
• Steal contacts list
• Collect device details and app lists
• Collect geo-location data
• Make USSD requests
• Forward calls
• Install and start other apps
• Start browsers on desired pages
• Lock the screen for a ransomware-like feature
• Sniff notifications showed on the device
• Steal 2FA codes generated by authentication apps

SRC:

Apps and specific package names for that are infected are listed below.

Src:

As you can see there is a massive number of affected apps so be super careful with what you are doing and I would strongly advise everyone reading this to audit your apps and if you don't need it, bin it!

Top image Src: