{"id":368243,"date":"2020-09-21T10:03:31","date_gmt":"2020-09-21T08:03:31","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=368243"},"modified":"2020-09-21T10:05:59","modified_gmt":"2020-09-21T08:05:59","slug":"hacker-group-developed-android-malware-to-steal-2fa-codes","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/368243-hacker-group-developed-android-malware-to-steal-2fa-codes.html","title":{"rendered":"Hacker group developed Android malware to steal 2FA codes"},"content":{"rendered":"

Security group Check Point has discovered<\/strong><\/a> an Iranian hacking group which developed malware capable of stealing two-factor authentication codes from Android devices.<\/p>\n

The group, which is reportedly involved in surveillance operations against Iranian minorities and resistance movements, uses various malware types across Windows and Android.<\/p>\n

The Windows malware tries to steal documents and passwords from targets’ computers, as well as files from Telegram’s Windows desktop client.<\/p>\n

However, Check Point has also discovered tools for Android, including the group’s two-factor authentication code stealer.<\/p>\n

What the tool does<\/h3>\n

Check Point explains that an Android backdoor was designed by the group under the guise of a harmless app.<\/p>\n

This software purports to helps Persian speakers in Sweden get their drivers’ licenses.<\/p>\n

The app asks the user to provide a variety of necessary permissions, and upon these being accepted, initiates several background services.<\/p>\n

One of these services is responsible for configuration monitoring, showing fake notifications, and sensitive data collection.<\/p>\n

Additionally, the following information is read and prepared by the service:<\/p>\n