In 55 days, KorBanker malware designed to steal banking information from Android devices managed to collect more than 10,000 text messages from 96 infected smartphones.
The banking malware is not new, its activity being monitored by security researchers since September 2013.
It reaches the devices of the users by masquerading as the Google Play app, and after installation it looks for the presence of mobile banking apps from a set of targeted banks.
If any such apps are detected, they are automatically deleted and replaced with a fake version; then it waits for text messages with two-factor authentication (2FA) for logging into accounts of targeted banks.
All the information in the spoofed banking apps and the SMS is then sent to a command and control (C&C) server.
Sensitive content in SMS communication
Full Article