Android virus Vultur steals user data

Cybersecurity company ThreatFabric, reported about the growing Vultur Trojan. It operates with a simple and straightforward method - which, however, helps an attacker collect logins and passwords from accounts of social networks and banking applications.

The authors claim this is the first time an Android virus has used screen and click recordings to collect data automatically. Scammers usually go the much more difficult route of HTML overlay, but Vultur achieves the same result with much less effort.

By itself, Vultur cannot get to the device - for this they use a dropper (something like a launch vehicle for a virus) Brunhilda. It disguises itself as a regular application (mainly programs for fitness, authentication or, ironically, security). After installing the application, Brunhilda activates, sends a signal to its creators and loads Vultur - of course, all this without the user's knowledge.

Prior to ThreatFabric data, about 30 thousand smartphones were infected in this way. It is noteworthy that similar programs were seen on Google Play.

It is extremely difficult to detect the presence of a virus on a device. You can only notice the data transfer icon - if you are not downloading anything, this may indicate that the software is transferring data to the server, but at the same time, the smartphone can simply install application updates or synchronize something in background.

However, there is a way to defend against Vultur - and a pretty simple one. Do not allow new applications to access the "Accessibility" of your smartphone (the name may vary depending on the manufacturer) and try not to install programs outside of Google Play. The latter, of course, does not guarantee your safety 100%, but it significantly increases the chances of protecting yourself not only from Vultur, but also from other malware.