A danger alarm has sounded for Android users. The new banking trojan, Sturnus Malware, is stealing bank details through fake login pages and can even spy on encrypted chats. Currently, Google has not released any security patch for this issue.
Android Banking Malware Alert: A new cyber attack emerging from Europe has raised concerns among Android users worldwide. What happened, where, and why? The straightforward answer is that a dangerous trojan named Sturnus is stealing users' private information by creating fake login screens for banking apps. This attack is currently limited to Europe, but researchers have warned that its impact could soon become global. A key concern is that this malware can also read encrypted chats through screen captures, posing serious questions about digital security.
Major Cyber Alert for Android Users
A major cyber warning has emerged for Android smartphone users. A new dangerous Android Banking Trojan, Sturnus, is rapidly targeting banking apps and is reportedly capable of stealing users' login details. According to cybersecurity reports, this malware is not limited to banking apps; it can also read chats from end-to-end encrypted apps like WhatsApp, Telegram, and Signal via screen captures.
Notably, Google has not yet released any new security patch to address this vulnerability. This makes the threat even more severe for Android users, especially those who rely on mobile banking and digital payment apps for their daily activities.
Steals Bank Details via Fake Login Pages
According to reports from ThreatFabric and research by MTI Security, Sturnus Malware creates fake login pages for banking apps that look exactly like the genuine ones. As soon as a user enters their user ID and password on such a fraudulent page, all information is directly transmitted to the cybercriminals' servers.
Researchers state that this malware also possesses remote access capabilities, allowing hackers to live-view every activity on the user's screen. It can also black out the screen and perform fraudulent transactions in the background, causing the user to realize the loss much later.
Reads Private Chats Without Breaking Encryption
The report also reveals that Sturnus does not break any app's encryption. Instead, as soon as a message appears decrypted on the phone's screen, it takes a screen capture. This is how it gains access to conversations on platforms considered secure, such as WhatsApp, Telegram, and Signal.
While all three messaging apps claim that third-party access to their chats is not possible, Sturnus bypasses this security indirectly by monitoring at the screen level, raising concerns among cybersecurity experts.
Initial Attacks in Europe, Threat May Spread Further
The initial cases of Sturnus have emerged in Southern and Central Europe. Researchers believe that the malware is currently in its early development stages and is being tested on a small scale. However, considering similar past trends, it could evolve into a large-scale cyber attack in the future.
Given the continuous emergence of small-scale attacks, experts have warned that if security measures are not implemented in a timely manner, this threat could rapidly spread globally.
