A new Android banking Trojan named Sturnus can bypass encrypted messaging apps like WhatsApp, Signal, and Telegram to steal users' banking details. It leverages Accessibility Services to extract money through fake login screens and black screen attacks. The Trojan prevents itself from being uninstalled and remains active for an extended period.
Android Security Alert: The new banking Trojan Sturnus can bypass the security of users' WhatsApp, Signal, and Telegram accounts to access their banking data. According to researchers at ThreatFabric, this malware directly steals money using fake login screens and black screen techniques. Sturnus has now been observed during testing in Southern and Central Europe and has the potential to target large financial institutions. Users must avoid installing unknown apps and use reliable security tools.
How Sturnus Attacks
Sturnus does not directly break encryption; instead, it abuses Android's Accessibility Services. As soon as a user opens WhatsApp, Signal, or Telegram, it scans the app's UI-tree to gain access to chats, contact lists, and messages. It can be installed by masquerading as trusted apps like Google Chrome or Preemix Box.
The characteristic feature of this malware is that it steals banking data by deploying fake login screens and black screen attacks. Upon logging in on the fake screen, usernames and passwords are sent directly to the hacker. With the black screen technique, the phone appears to be off, but transactions can occur in the background.
Difficult to Remove and Protect Against
Sturnus protects itself from uninstallation by granting itself Device Administrator access. It continuously monitors battery, network, and sensor activity. If a user attempts to remove it, it either closes settings or simulates a back button click to remain active. Researchers warn that this Trojan can remain active for a long time and employs highly advanced techniques.
It is time for Android users to be vigilant. Malware like Sturnus can bypass the encryption of secure messaging apps and cause significant financial damage. Users should avoid installing unknown links or apps and use reliable security tools.
