Drinik Malware Now Targets 18 Indian Banks

 

A new upgraded variant of Drinik Android trojan is targeting 18 Indian banks and stealing personal and bank account information from the victims. Drinik has been circulating in India and operating as an SMS stealer since 2016,

 

The new campaign

Drinik is impersonating the Income Tax Department of India and targeting potential victims across 18 Indian banks to steal their income tax credentials.

• The latest variant of the malware, found in August, is being distributed as an APK file (iAssist.apk) that is integrated into the iAssist app for Android.
• It lures victims to claim an instant tax refund, tricking them into submitting personal details such as full name, Aadhar number, PAN number, and financial information.
• The phishing scam is targeting 18 Indian banks, including the State Bank of India by abusing Accessibility Service. This way, it obtains the necessary permissions to perform several tasks on the compromised systems.

 

Other variants

Researchers disclosed two other variants—spotted in February, 2022 and September, 2021—primarily harvesting credentials via phishing pages. However, the latest variant is equipped with some advanced capabilities as well.

 

What are the advanced capabilities?

• The latest malware is capable of screen recording and keylogging to harvest credentials. It abuses CallScreeningService to manage incoming calls.
• It receives commands via FirebaseCloudMessaging and launches overlay attacks.

 

A previous connection

• According to Cyble researchers, the latest campaign is launched by the same group that attacked Indian banks in September 2021.
• The group used the same IP address for its command and control communication in both campaigns.

 

How to stay safe from Drinik malware?

Step 1: Download and install apps from Play Store only.

Step 2: Enable biometric authentication security on apps and for the lock screen.

Step 3: Never click on a link you receive from a random number or source.

Step 4: Use Google Play Protect to check your apps and devices for harmful behavior. Google Play Protect is on by default, but you can turn it off. For security, we recommend that you always keep Google Play Protect on.

            I. Open the Google Play Store app Google Play.

            II. At the top right, tap the profile icon.

            III. Tap Play Protect and then Settings.

            IV. Turn Scan apps with Play Protect on or off.

Step 5: Change app permissions on your Android phone: You can allow some apps to use various features on your phones, such as your camera or contacts list. An app will send a notification to ask for permission to use features on your phone, which you can Allow or Deny.

You can also change permissions for a single app or by permission type in your phone's Settings.