GODFATHER ANDROID MALWARE RUNS REAL APPS IN A SANDBOX TO STEAL DATA

Summary from the TLDR InfoSec newsletter

Researchers from Zimperium zLabs unveiled a new variant of the GodFather Android malware that uses on-device virtualization to deploy real banking and cryptocurrency apps in a controlled sandbox. This method allows attackers to monitor and steal user credentials stealthily, as the malware disguises itself by installing a hidden host app that redirects users to virtualized versions of these applications. Primarily targeting 12 Turkish financial institutions, the malware affects 484 applications globally and employs overlays and Android accessibility services to enhance control over devices.