Creating phony versions of banking sites is one of the oldest phishing schemes in the book, but these attackers took a more subtle approach. They scanned the other, legitimate apps on the device, grabbed some HTML code and used it to create a tailor-made form to fool victims with bogus error messages.
Some victims received a notification that their app was no longer compatible with their device and had been removed, for instance. Meanwhile, the attackers used a dropper to check for sandboxes and emulators. If they didn’t find any, a loader was decrypted with a payload containing the banking malware.
The 29 malicious apps included popular utilities such as battery managers, device boosters and cleaners, the researchers noted. Others, such as phony horoscope apps, targeted users seeking casual entertainment.