Android users, beware. A security consulting firm has identified a malware upgrade that can remotely access smartphones to steal unlock credentials and 2FA Google Authenticator codes.
The update report comes from Dutch mobile security firm ThreatFabric (via ZDNet) and details the alarming Remote Access Trojan (RAT) capabilities bestowed on the Cerberus banking Trojan that launched last summer. When enabled in a victim's phone, RAT features let Cerebrus operators record the user's unlock PIN, swipe pattern and even Google Authenticator's 2FA codes.
- The best antivirus right now
- Plus: Apple Powerbeats 4 launching soon: What we know so far
- More security scares: 3 billion images stolen from facial recognition database
Google Authenticator is a useful tool that helps people add an extra layer of security to their important accounts, including those used for online banking. But according to ThreatFabric, Cerberus's new RAT powers would let attackers steal the 2FA code, access a victim's financial account and transfer funds to themselves.
Of course there's a plethora of information hackers could nab with Authenticator codes, but banking is Cerberus's usual target.
Because Google Authenticator codes are created and stored locally on phones, online accounts with 2FA layers from Authenticator are considered better protected than those that use one-time, SMS-based credentials.
But should Cerberus's RAT upgrade reach bad actors, Authenticator would be compromised.
To some relief, ThreatFabric says the RAT feature is not active in version of Cerberus currently advertised and sold on hacking forums. However, researchers say it "might be released soon," meaning hackers could get their hands on the advanced malware.
Knowing that malware has these new capabilities likely means measures are already being taken by Android and app developers to bulk up software security.
Although there's no action users can take now, make sure to always install security updates as soon as they become available.
