{"id":185050,"date":"2022-03-08T11:37:08","date_gmt":"2022-03-08T10:37:08","guid":{"rendered":"http:\/\/sftarticles.wpenginepowered.com\/en\/?p=185050"},"modified":"2025-07-01T20:54:18","modified_gmt":"2025-07-02T03:54:18","slug":"sharkbot-malware-android","status":"publish","type":"post","link":"https:\/\/cms-articles.softonic.io\/en\/sharkbot-malware-android\/","title":{"rendered":"SharkBot Banking malware masquerades as Android antivirus app"},"content":{"rendered":"\n

Malware analysts have uncovered a threat actor<\/strong> behind a particularly nasty Android banking app trojan named SharkBot. SharkBot <\/strong>has evaded Google Play Store<\/a>\u2019s security framework for a while, hiding within the coding of deceptive antivirus apps. <\/p>\n\n\n\n

Similar to its contemporaries, TeaBot, Oscorp (UBEL), and FluBot, SharkBot belongs to a virulent category of financially-centered<\/strong> malicious software designed to gain access to users\u2019 banking information. It is able to achieve this by circumventing complex authentication mechanisms and thus siphon banking app credentials<\/strong> and initiating financial transfers from infected devices. <\/p>\n\n\n\n

SharkBot does, however, have a few key differences to its contemporaries that make it a far more dangerous trojan. While other malicious software like TeaBot requires a live operator to remotely interact with the compromised device, SharkBot is capable of leveraging Automatic Transfer Systems.<\/strong> This means that it can carry out unauthorized financial transactions without a third party interacting with infected devices. <\/p>\n\n\n\n

In a recent report, malware analysts at the NCC Group cybersecurity firm said the following: \u2018The ATS features allow the malware to receive a list of events to be simulated, and they will be simulated in order to do the money transfers. Since these features can be used to simulate touches\/clicks and button presses, it can be used to not only automatically transfer money but also install other malicious applications or components.\u2019 <\/p>\n\n\n\n

What this means is that once SharkBot has infiltrated a user\u2019s device, it can virtually do anything<\/strong>. It\u2019s able to record touches and keystrokes, create false overlays to trick you into interacting with it instead of your legitimate apps, and even install other malware without your knowledge. <\/p>\n\n\n\n

Four apps have been identified on Google Play as containing the trojan. All four are antivirus apps:<\/p>\n\n\n\n