FinStealer Malware Breach: Login Credentials Safety Tips

The “FinStealer” is a sophisticated malware campaign that targets customers of a leading Indian bank via fraudulent mobile apps. The security researchers at CYFIRMA identified the malware as Trojan.rewardsteal/joxpk, intended to steal banking credentials and personal information from unsuspecting users. 

Let’s know more about this. 

Keep reading?

How the Malware Operates

The site, under a pretty suspicious domain, is called Motocharge [.]online and distributes fake banking apps designed similarly to the real ones. 

Once installed, the malicious software starts performing its operations without the user’s knowledge, collecting sensitive information from the users. 

CYFIRMA analysts found that FinStealer is built using Kotlin and employs advanced evasion techniques, including:

• XOR-based string obfuscation to bypass detection
• A dual command-and-control (C2) infrastructure, using both IP-based servers (41.216.183.97) and Telegram bots
• WebView exploitation to capture user credentials

The malware communicates with its C2 infrastructure through a Telegram bot, using the API key: 7754264825:AAEqSBGNuEbuMqnWFqN7E_SvhS5sy_IFjEE. The stolen data includes:

• Banking credentials
• Credit card details
• Personal identification information

Related Read: Top 7 Tips to Safeguard Your Digital Identity Like a Pro!

Security Risks and Recommendations

A critical vulnerability (CVE-2011-2688) was also discovered on the C2 server that permits SQL injection attacks through the mysql/mysql-auth.pl script in the mod_authnz_external module. 

To protect against this persistent threat, CYFIRMA recommends the following: 

• Advanced endpoint protection Implementation
• Exploit-like behavior Monitoring 
• Regular security audits of mobile applications 
• Block all known malicious indicators of compromise (IOCs). 

The below-mentioned YARA rule might help in identifying malware:

Staying Safe from FinStealer

The campaign continues; therefore, researchers keep watching for new variants and attack vectors. Users are advised to download banking apps from only legitimate sources and verify them upon installation to avoid falling prey to this shadowy malware attack.

Read More: Malware vs. Viruses: Learn the Differences and Protection Tips

How to Spot Login Credential Fraud

Login credential fraud is a critical danger in today’s digital landscape. Cybercriminals use malware and malicious assaults to steal your login credentials, doubtlessly leading to identity theft and credit card fraud. 

Here are some key signs to watch for:

• Unexpected Login Alerts: If you receive notifications from unfamiliar devices or locations, it’s a red flag.
• Suspicious Emails or SMS: Don’t forget to verify any messages asking to authenticate your login or prompting a password change.
• Account Changes: Unaccounted changes in account settings could imply a breach has occurred.

Utilize robust anti-malware solutions and mobile malware protection to guard your accounts.

Can Your Device Handle A Malware Attack?

AVP Suite stops threats before they strike, protecting data and devices from malware

Try AVP Suite for Free!

How to Protect Your Login Credentials

Your login information is essential to avoiding identity theft and preserving your personal data. 

Follow these steps to build a robust defense against malicious attacks and data breaches:

• Create Strong, Unique Passwords:
  Use a mix of letters, numbers, and symbols for every account. Avoid easily identifiable information to reduce the risk of malware or an attack to obtain login credentials.
• Enable Two-Factor Authentication (2FA):
  A second layer of security primarily ensures that unauthorized users are denied access if someone’s password is obtained.
• Utilize AVP Total Security:
  Obtain AVP Total Security or invest in a total anti-malware solution to establish ongoing protection against malware and secure mobile devices. Its advanced capability protects the user from all known and emerging threats. 
• Regular Software Updates:
  Keep your operating system and apps up to date; Patches and updates to software fix vulnerabilities malicious users will exploit to protect against a data breach.
• Monitor Account Activity:
  Don’t forget to check your accounts regularly to identity any suspicious activities. 
• Secure Your Devices:
  These proactive measures provide significant protection from identity theft and secure access to your computer, all about integral data safety defense for peace of mind in this digital world.
• Be Cautious on Public Wi-Fi:
  Never use accounts over a public network. Use a secure VPN if needing to use public Wi-Fi.

Following these security measures rigorously can significantly increase your protection from identity theft and secure your login credentials. Embrace these practices for stronger data security and peace of mind in today’s digital world.

Want to know more about digital identity and login credential protection? 

Visit the AVP Suite for enhanced security!