‘Massiv’ Android malware poses as IPTV app to steal banking credentials

A new Android banking malware, dubbed Massiv, is disguised as an IPTV application to steal digital identities and gain access to online banking accounts, ThreatFabric reports. The malware employs screen overlays and keylogging techniques to harvest sensitive data and can seize remote control of infected devices, with further coverage provided by Bleeping Computer.

Massiv has been observed in campaigns targeting a Portuguese government app linked to the Chave Móvel Digital, Portugal's digital authentication system. This allows attackers to bypass know-your-customer verifications and access banking and other online services. The malware offers two remote control modes: live screen streaming and UI-tree extraction via the Accessibility Service, enabling it to bypass screen-capture protections.

The use of IPTV apps as a lure is a growing trend, as these apps are often downloaded from unofficial channels, making users more susceptible to sideloading malware. Attackers create fake IPTV apps that either install the malware directly without additional functionality or display an IPTV website in a WebView to maintain the illusion. These campaigns have primarily targeted users in Spain, Portugal, France and Turkey. Users are strongly advised to download applications only from official sources like Google Play, ensure Play Protect is active, and regularly scan their devices.

Source: Bleeping Computer