New BankBot-YNRK, DeliveryRAT Android banking trojans examined

Android users could have their devices' data exfiltrated by the new BankBot-YNRK and DeliveryRAT banking trojans, The Hacker News reports.

Three malicious APK packages seemingly impersonating an official Indonesian government app have been used to deploy BankBot-YNRK, which not only checks for virtualized or emulated environments but also inspects for certain devices running on Android 13 or older for tailored functionality, before proceeding with device data harvesting, audio volume manipulation, lures to activate accessibility services, according to a CYFIRMA analysis.

On the other hand, Android users across Russia were reported by F6 researchers to have been subjected to an attack campaign spreading a new DeliveryRAT malware version in the form of banking, food delivery, marketplace, and parcel tracking apps. Apps spreading DeliveryRAT seek notification and battery optimization settings access to facilitate SMS message and call log compromise, said F6 researchers, who also discovered the malware to allow distributed denial-of-service intrusions.

Such findings follow a Zimperium report detailing the emergence of over 760 Android apps exploiting NFC to steal payment details.