Sophisticated FvncBot Android banking trojan examined

Mobile banking users across Poland have been subjected to attacks with the new and highly advanced FvncBot Android banking trojan, according to GBHackers News.

Installation of a seemingly legitimate "Play component" prompted by a loader app leads to the distribution of FvncBot, which then harnesses Android accessibility services for extensive keylogging and clandestine user interaction tracking as part of a two-stage infection process, a report from Intel 471 researchers showed. Opening targeted banking apps triggers the appearance of overlay windows with phishing pages that enable credential exfiltration, said researchers, who also noted FvncBot's ability to allow remote device compromise.

Apart from enabling app launches, arbitrary data inputs, and clipboard alteration, FvncBot also permits device locking, audio silencing, and black overlays to conceal illicit activity. Moreover, anti-screenshot capturing measures have been circumvented by the malware through Hidden Virtual Network Computing functionality that examines UI elements for device screen reconstruction.