A highly technical Android malware campaign by Vietnamese hackers is targeting Indian users through fake traffic e-challan messages on WhatsApp, according to a report on Wednesday.<\/p>\n\n\n\n
Researchers from CloudSEK, a cybersecurity firm, identified the malware as part of the Wromba family.<\/p>\n\n\n\n
It has infected more than 4,400 devices and led to fraudulent transactions exceeding Rs. 16 lakh by just one scam operator, they said.<\/p>\n\n\n\n
“Vietnamese threat actors are targeting Indian users by sharing malicious mobile apps on the pretext of issuing vehicle challan on WhatsApp,\u201d said Vikas Kundu, Threat Researcher, CloudSEK.<\/p>\n\n\n\n
Scammers are sending fake e-challan messages impersonating the Parivahan Sewa or Karnataka Police and tricking people into installing a malicious app.<\/p>\n\n\n\n
The app steals personal information and also facilitates financial fraud.<\/p>\n\n\n\n
Clicking the link within the WhatsApp message would lead to the download of a malicious APK disguised as a legitimate application.<\/p>\n\n\n\n
Once installed, the malware requested excessive permissions, including access to contacts, phone calls, SMS messages, and the ability to become the default messaging app.<\/p>\n\n\n\n
It then intercepts OTPs and other sensitive messages, which enables attackers to log in to victims’ e-commerce accounts, purchase gift cards, and redeem them without leaving a trace.<\/p>\n\n\n\n
Kundu explained that once the app gets installed, it extracts all the contacts to scam more users.<\/p>\n\n\n\n
Further, all the SMSes will be \u201cforwarded to the threat actors thus allowing them to log in to various e-commerce and financial apps of the victim,\u201d he added.<\/p>\n\n\n\n
Using proxy IPs, the attackers avoid detection and maintain a low transaction profile.<\/p>\n\n\n\n
Using the malware, attackers have accessed 271 unique gift cards, conducting transactions worth Rs 16,31,000, according to the report.<\/p>\n\n\n\n
Gujarat has been identified as the most affected region, followed by Karnataka.<\/p>\n\n\n\n
To protect against such malware threats CloudSEK urged users to stay vigilant and adopt security best practices installing apps only from trusted sources like Google Play Store; limiting app permissions and regularly reviewing them, maintaining updated systems, and enabling alerts for banking and sensitive services. AGENCIES<\/p>\n","protected":false},"excerpt":{"rendered":"
A highly technical Android malware campaign by Vietnamese hackers is targeting Indian users through fake traffic e-challan messages on WhatsApp, according to a report on Wednesday. Researchers from CloudSEK, a cybersecurity firm, identified the malware as part of the Wromba family. It has infected more than 4,400 devices and led to fraudulent transactions exceeding Rs. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"footnotes":"","_jetpack_memberships_contains_paid_content":false,"jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[87],"tags":[],"jetpack_publicize_connections":[],"yoast_head":"\n