<\/p>\n
A new type of Android banking trojan has emerged that can bypass encrypted messaging apps like WhatsApp, Telegram and Signal to steal users\u2019 banking credentials. As per security researchers at ThreatFabric, the new trojan, called Sturnus, possesses dangerous abilities even though it is still in its testing phase.<\/p>\n<\/div>\n
The researchers warn that Sturnus has already been configured with targets against financial institutions across Southern and Central Europe, suggesting that preparations for a broader campaign are underway. The malware is also said to be more advanced than current and more established malware families in areas like communication protocol and device support.<\/p>\n<\/div>\n
The name \u201cSturnus\u201d was inspired by Sturnus vulgaris (the European Starling), a medium-sized passerine bird known for its rapid, irregular vocal patterns. Researchers drew the parallel because the malware\u2019s communication protocol switches unpredictably between simple and complex messages, resembling the bird\u2019s rapid, irregular chatter.<\/p>\n<\/div>\n
As mentioned earlier, Sturnus possesses the ability to bypass end-to-end encryption on messaging apps like WhatsApp<\/a>, Signal and Telegram<\/a>. The malware does not \u201chack\u201d the encryption protocol itself but instead abuses the Accessibility Services settings on Android.<\/p>\n<\/div>\n Sturnus reads the messages directly from the user\u2019s screen after the phone decrypts them. This means it can monitor incoming and outgoing messages in real time and view information like contact lists and full conversation threads.<\/p>\n<\/div>\n