Android 2FA apps are becoming more and more popular, as they offer a more secure way to sign in to your account. However, there are some apps that are using Android 2FA without your knowledge or consent. One such app is called “Android 2FA Authy.” This app is stealing bank accounts without you knowing it. If you’re using an Android 2FA app, be sure to review the permissions that the app has requested. If the app asks for access to your contacts or other personal information, then it’s likely that the app is using Android 2FA without your permission. If you don’t want the app to have these permissions, then make sure to revoke them before signing in to your account. If you’re not comfortable with using an Android 2FA app, then be sure to research how to create a strong password for yourself. This will help protect your account from being stolen by an unknown person or application.
Researchers from Pradeo discovered the app, which was aptly named 2FA Authenticator. It installs a trojan called Vultur, which has been infecting Android phones for over a year.
Roxane Suau from Pradeo said, “Our analysis revealed that the dropper automatically installs a malware called Vultur, which targets financial services to steal users’ banking information.”
Apparently, the app was well-designed to look like a legitimate 2FA tool. According to Pradeo, “It has been developed to look legitimate and provide a real service. To do so, its developers used the open-source code of the official Aegis authentication application to which they injected malicious code.”
The malware works in two stages. First, it profiles the user. It collects and sends the user’s application lists and location data, which allows the attackers to target their actions. During this phase, it will disable the keylock and any associated password security and download other third-party apps disguised as updates.
For stage two, the researchers found that the attack is conditioned to the information the app finds on its users. When some conditions are met, the dropper installs Vultur, the malware that primarily targets online banking interfaces to steal credentials and financial information, which is obviously scary.
This is not a piece of malware to be taken lightly. If you installed this app (which has been removed from Google Play but is still available on some third-party app stores), you need to delete it immediately. If the app starts relaunching itself when you try to close it, restart your phone and delete it.
RELATED: How to Securely Shop Online: 8 Tips to Protect Yourself
