Vulnerabilities / Threats

6/23/2017
02:08 PM
50%
50%

Android Marcher Variant Makes Rounds as Adobe Flash Player Update

Zscaler researchers discover a new variant of the Android Marcher malware, which aims to steal online banking credentials and credit card information.

A new variant of the Android Marcher malware uses pornographic enticements and new game hype to lure users to download a bogus Adobe Flash player, according to Zscaler researchers who discovered the latest variant.

Users are then asked to disable their security settings and allow third-party apps to install. Once the apps are installed, the malware removes its icon from the phone menu.

It then waits for the user to open one of over 40 targeted financial apps and then overlays a fake version of that financial website's login page. The malware then gleans the user's login credentials.

The financial sites the new Android Marcher variant is targeting includes TD Bank, Wells Fargo, PayPal, and others.

Read more about this latest Marcher variant here

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
'Hidden Tunnels' Help Hackers Launch Financial Services Attacks
Kelly Sheridan, Staff Editor, Dark Reading,  6/20/2018
Tesla Employee Steals, Sabotages Company Data
Jai Vijayan, Freelance writer,  6/19/2018
Inside a SamSam Ransomware Attack
Ajit Sancheti, CEO and Co-Founder, Preempt,  6/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-2668
PUBLISHED: 2018-06-22
389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind requests are handled. A remote unauthenticated attacker could use this flaw to make ns-slapd crash via a specially crafted LDAP bind request, resulting in denial of service.
CVE-2017-7466
PUBLISHED: 2018-06-22
Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the An...
CVE-2018-12648
PUBLISHED: 2018-06-22
The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.
CVE-2018-12641
PUBLISHED: 2018-06-22
An issue was discovered in arm_pt in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_arm_hp_template, demangle_class_name, demangle_fund_type, do_type, do_...
CVE-2018-12642
PUBLISHED: 2018-06-22
Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user.