Sophisticated Frogblight Android trojan targets Turkey

Official Turkish government apps have been spoofed to deliver the new Frogblight Android banking trojan, which merges banking credential exfiltration and spyware capabilities, to mobile users across the country, GBHackers News reports.

Malicious SMS messages warning recipients of legal proceeding involvement have been leveraged by threat actors to lure them into downloading a seemingly legitimate app to view court case files, which installs Frogblight, an analysis from Kaspersky revealed. After opening the real Turkish government webpage for accessing court files within WebView and seeking additional Android device permissions, Frogblight installs illicit JavaScript code to enable the theft of all user data inputted following online banking logins.

Newer iterations of Frogblight, which masqueraded as the Chrome browser, were discovered to have been integrated with contact list theft, keylogging, call log gathering, and other spyware functionality, according to researchers, who noted that the malware also avoids execution in the U.S. and emulator environments.