This access, Lu points out, is what enables the attacker to bypass may two-factor authentication systems. Worse, the malware has been given permission to send and receive text messages. Once given administrative rights, the app can’t easily be uninstalled from the device, Lu writes. Next, the Flash Player icon is then hidden and the malware remains active in the background of the device, Fortinet said. Doing so grants full device administrator rights to the malware.

The only way to make the overlay go away is to choose “activate” from the menu choices. If the user decides to cancel the download, the window closes only to reappear again. Attackers are able to con users into activating the malware via a bogus Google Play Service screen that is actually a screen overlay. According to Lu, when a user launches the bogus Flash Player, “the user is tricked into granting device administrator rights to the app through a fake Google Play Service” (below). If installed, it creates an icon on the Android device’s application launcher screen. Due to its ability to intercept SMS communications, the malware is also able to bypass SMS-based two-factor authentication,” said security analyst Kai Lu at Fortinet.Īccording to Fortinet, the malware is spreading in the United States, Germany, France, Australia, Turkey, Poland and Austria. “This banking malware can steal login credentials from 94 different mobile banking apps. While it is not available via the Google Play app store, it’s unclear how it’s being distributed. Fortinet researchers said Tuesday the phony Flash Player was spotted Oct. Wells Fargo, Discovery Financial and Chase customers, along with services such as Skype, Snapchat and Facebook are targeted in these attacks. Security researchers warn that a bogus Flash Player app aimed at Android mobile devices has surfaced and is luring victims to download and install banking malware that steals credit card information and can defeat two-factor identification schemes.

Firestarter apk download 2016