Fake e‑shops on the prowl for banking credentials using Android malware

The popularity of online shopping has been growing during the past few years, a trend accelerated by the pandemic. To make this already convenient way of never having to leave the couch to buy new things even more convenient, people are increasingly using their smartphones instead of computers to shop: in Q1 2021, smartphones accounted for 69% of all retail website visits worldwide, and smartphone purchases made up 57% of online shopping orders. A noteworthy aspect of buying goods and services via a mobile device is that 53% of smartphone users do it from vendor-specific applications.

Seeking the opportunity to make a profit off this behavior, cybercriminals exploit it by tricking eager shoppers into downloading malicious applications. In an ongoing campaign targeting the customers of eight Malaysian banks, threat actors are trying to steal banking credentials by using fake websites that pose as legitimate services, sometimes outright copying the original. These websites use similar domain names to the services they are impersonating the better to attract unsuspecting victims.

Campaign overview

This campaign was first identified at the end of 2021, with the attackers impersonating the legitimate cleaning service Maid4u. Distributed through Facebook ads, the campaign tempts potential victims to download Android malware from a malicious website. It is still ongoing as of the publication of this blogpost, with even more distribution domains registered after its discovery. In January 2022, MalwareHunterTeam shared three more malicious websites and Android trojans attributed to this campaign.

On top of that, ESET researchers found four more fake websites. All seven websites impersonated services that are only available in Malaysia: six of them, Grabmaid, Maria’s Cleaning, Maid4u, YourMaid, Maideasy and MaidACall, offer cleaning services, and the seventh is a pet store named PetsMore. The side-by-side comparison of the legitimate and copycat versions of Grabmaid and PetsMore can be seen in Figures 1 and 2, respectively.

Figure 1. Grabmaid: legitimate website on the left, copycat on the right

Figure 2. PetsMore: legitimate website on the left, copycat on the right

The copycat websites do not provide an option to shop directly through them. Instead, they include buttons that claim to download apps from Google Play. However, clicking these buttons does not actually lead to the Google Play store, but to servers under the threat actors’ control. To succeed, this attack requires the intended victims to enable the non-default “Install unknown apps” option on their devices. Interestingly, five of the seven legitimate versions of these services do not even have an app available on Google Play.

To appear legitimate, the applications ask the users to sign in after starting them up; there is however no account validation on the server side – the software takes any input from the user and always declares it correct. Keeping up the appearance of an actual e-shop, the malicious applications pretend to offer goods and services for purchase while matching the interface of the original stores (see Figure 3 for a screenshot of the shopping cart in one of the malicious apps). When the time comes to pay for the order, the victims are presented with payment options – they can pay either by credit card or by transferring the required amount from their bank accounts. During our research, it was not possible to pick the credit card option.

Figure 3. The shopping cart in a malicious application

As we already mentioned, the goal of the malware operators is to obtain the banking credentials of their victims. After picking the direct transfer option, victims are presented a fake FPX payment page and asked to choose their bank out of the eight Malaysian banks provided, and then enter their credentials. The targeted banks are Maybank, Affin Bank, Public Bank Berhad, CIMB bank, BSN, RHB, Bank Islam Malaysia, and Hong Leong Bank, as seen in Figure 4.

Figure 4. Targeted banks

After unfortunate victims submit their banking credentials, they receive an error message informing them that the user ID or password they provided was invalid (Figure 5). At this point, the entered credentials have been sent to the malware operators, as Figure 6 shows.

Figure 5. Error message displayed to the victim after credentials are exfiltrated

Figure 6. Credentials being sent to the attacker’s server

To make sure the threat actors can get into their victims’ bank accounts, the fake e-shop applications also forward all SMS messages received by the victim to the operators in case they contain Two-Factor Authentication (2FA) codes sent by the bank (see Figure 7).

Figure 7. All received SMS messages are forwarded to the attacker’s server

Malware description

The observed malware is rather minimalistic: it is designed to request only one user permission, which is to read received SMS messages. Its goal is to phish for banking credentials and forward 2FA SMS messages from the compromised device to the operators. Lacking the functionality to remove SMS messages from the device, the malware cannot hide that somebody is trying to get into the victim’s bank account.

So far, the malware has been targeting only Malaysia – both the e-shops it impersonates and the banks whose customers’ credentials it is after are Malaysian, and the prices in the applications are all displayed in the local currency, the Malaysian Ringgit.

One of the services impersonated in the campaign, MaidACall, has already warned its users of this fraudulent campaign via a Facebook post (see Figure 8). The rest have not publicly commented on the issue yet.

Figure 8. Warning post by a service that was impersonated during the campaign

We have found the same malicious code in all three analyzed applications, leading us to conclude that they can all be attributed to the same threat actor.

Takeaways

To protect yourself against this type of threat, first, try to ensure that you are using legitimate websites to shop:

• Verify if the website is secure, i.e., its URL begins with https://. Some browsers might even refuse to open non-HTTPS websites and explicitly warn users or provide an option to enable HTTPS-only mode.
• Be wary of clicking ads and do not follow paid search engine results: it is possible that they do not lead to the official website

Apart from looking out for fake websites, here are some other useful tips to enjoy a safer online shopping experience on your smartphone:

• Pay attention to the source of applications you are downloading. Make sure that you are actually redirected to the Google Play store when getting an application
• Use software or hardware 2FA instead of SMS when possible
• Use mobile security solutions to detect harmful websites and malicious apps

Conclusion

The observed campaign is a fake e-shop scheme targeting the banking credentials of Android users in Malaysia. It exploits the popularity of using smartphones to shop online. Instead of phishing for banking credentials on websites, the threat actors have introduced Android applications into the chain of compromise, thus making sure they have access to 2FA SMS messages the victim is likely to receive. The scheme relies on using ads to lure potential victims into accessing copycat versions of legitimate websites. Once there, a fake Google Play download button directs them towards a malicious application distributed by the malware operators via a third-party site.

While the campaign targets Malaysia exclusively for now, it might expand to other countries and banks later on. At this time, the attackers are after banking credentials, but they may also enable the theft of credit card information in the future.

Indicators of compromise (IoCs)

Samples

Network

MITRE ATT&CK techniques

This table was built using version 10 of the ATT&CK framework.