Dangerous malware called “DroidBot” is currently targeting users of banking apps and cryptocurrencies in several European countries.
According to Cleafy researchers, who discovered this threat in June 2024, the “DroidBot” malware targets more than 77 different applications in the United Kingdom, Italy, France, Spain and Portugal. DroidBot operates on a malware-as-a-service (MaaS) model, offered to cybercriminals for $3,000 per month.
Researchers have already identified 17 affiliate groups using this service to tailor their attacks to their specific targets. Although the malware does not have particularly innovative features, analysis of one of its botnets revealed 776 unique infectionsmainly in the United Kingdom, Italy, France, Turkey and Germany.
Also read – This Android malware returns in an even more dangerous version that can empty your bank account
What is DroidBot, this new malware plaguing France?
The developers, believed to be of Turkish origin, provide their clients with a comprehensive set of attack tools, including a malware generator, command and control (C2) servers, as well as a central administration panel. Affiliates can thus customize DroidBot to target specific applications and set different settings, including language and C2 server addresses.
-Malware usually impersonates popular apps comme Google Chrome, Google Play Store ou « Android Security » to deceive users. Once installed, it deploys several malicious features: a keylogger, fraudulent login pages superimposed on legitimate banking interfaces, interception of SMS (in particular to steal two-factor authentication codes), and a control module remotely allowing hackers to take control of the infected device.
Targeted applications include major banking services such as BBVA, Unicredit, Santander, BNP Paribas and Crédit Agricoleas well as cryptocurrency platforms like Binance, KuCoin and Kraken.
To protect themselves, Android users are recommended to only download apps from the Google Play Storecarefully review permission requests during installation, and ensure Play Protect is enabled on their device. Particular attention should be paid to applications requesting access to accessibility services, which are often abused by malware.
