New Android malware appears: using virtualization to avoid sandbox mechanism to steal online banking funds of Southeast Asian users

Thanks to CTOnews.com netizen Bae Yang, OC_Formula for clue delivery! CTOnews.com December 3 news, comprehensive bleeping computer and other foreign media reports, recently a new type of Android malware has been found to use "virtualization" technology to avoid detection, and for its operators to earn huge profits.

The malware, called FjordPhantom, spreads via phishing emails, text messages and chat tools. According to reports, it uses virtualization solutions from open source projects to create virtual containers on devices without users 'knowledge.

Victims are tricked into downloading what appear to be legitimate banking apps, but they contain malicious code running in virtual environments that can attack real banking apps. The goal of FjordPhantom is to steal online bank account credentials and manipulate transactions by committing fraud on the device.

It is worth noting that the most cunning part of this malware is that it does not modify the bank App itself, making traditional code tampering detection invisible to the threat.

The malware was discovered by Promon, which pointed out that the malware's "virtualization" technique evaded Android's sandbox mechanism.

FjordPhantom targets banking applications in Indonesia, Thailand, Vietnam, Singapore and Malaysia. Promon said a victim lost $280,000 due to a combination of malware and social engineering (CTOnews.com notes: currently about 1.999 million yuan).