Android Users—New Malware Hijacks Bank Calls, Reroutes To Attackers

The evolution of malware is a relentless game of cat and mouse, and Android users are once again in the crosshairs.

Initially, FakeCall malware was a simple scam designed to mimic legitimate banking apps and trick users into divulging sensitive information through fake call screens.

While effective at leveraging social engineering, early versions were limited to visual deception. Today, a more sophisticated version has emerged—equipped with the ability to intercept calls, record conversations and monitor device activity—making it a formidable threat capable of executing complex and highly convincing fraud.

The New And Improved FakeCall Malware

As reported by TheHackerNews, the new FakeCall malware starts by tricking users into downloading a seemingly legitimate app. Once installed, it requests to be set as the default phone app. This step is crucial as it allows the malware to control calls on the device.

From there, when a user tries to make a call or receives one, the malware can intercept and reroute the call to a fake number controlled by attackers, so they believe they are speaking to real bank representatives.

Differences Between The Old And New FakeCall

Recording Audio and Screens

Previous versions of FakeCall mainly tricked users by showing fake call screens, mimicking legitimate apps to make users think they were speaking with their bank. The new variant takes this further by using Android’s screen recording and audio capture capabilities. This allows attackers to spy on live conversations, potentially gathering personal or financial details in real-time.

Monitoring Device Activity

While older versions had limited surveillance abilities, the updated malware can track more aspects of device behavior, including monitoring Bluetooth status. This not only helps attackers understand when users are active but also makes it easier for them to anticipate interactions, improving their chances of successfully extracting sensitive information.

Mimicking Real User Interactions

A major leap forward in the new variant is its seamless integration with Android’s system. This ability enables the malware to mimic real user interactions, making it appear more legitimate. For example, the malware can simulate actions that a user would normally take, such as toggling settings or responding to prompts.

This deception helps it avoid detection and makes its behavior look natural. These new capabilities make the latest FakeCall version more intrusive and capable of executing complex, layered fraud operations.

Example Attack Scenario

Imagine John, an Android user, downloads an app he believes is his bank’s latest mobile application. The app looks convincing, complete with logos and familiar user interface elements. However, this app is laced with the new FakeCall malware. John sets it as the default dialer after a prompt suggests it will “improve call quality.”

When he calls customer service to report a suspicious transaction, the malware intercepts the call and seamlessly redirects it to an attacker. On the other end, a scammer impersonates a bank representative with a calm and authoritative tone.

John provides personal information, believing it is required for verification. Meanwhile, the malware is covertly recording the audio and capturing John’s on-screen interactions as he accesses account details or enters security codes.

John completes the call reassured that the issue is being handled. Little does he know, the attacker now has the data needed to access his bank account, initiate transactions and compromise his financial security.

This seamless deception leaves no immediate clues, allowing the attacker to act swiftly before John realizes anything is amiss.

ForbesGoogle’s Live Threat Detection Is Almost Here—Apps Will Be Disabled In Next 10 WeeksBy Zak Doffman

Good Safety Practices When Downloading Apps

• Download Apps Only from Trusted Sources: Always use verified app stores like Google Play to minimize the risk of downloading malware. These platforms perform security checks on the apps they host, providing a layer of protection. Be cautious of Android Package Kits, or APKs, from third-party sites, as they often bypass these security measures.
• Regularly Check App Permissions: Review and adjust the permissions your apps have. Apps should only have access to what they need to function. For instance, a weather app doesn’t need access to your calls or screen recording capabilities. Pay close attention to apps requesting permissions for screen access, call handling, or SMS messaging as these can be exploited by malware like FakeCall.
• Keep Devices Updated: Ensure your device’s operating system and all installed apps receive regular updates. Developers issue updates not only for new features but also to patch known security vulnerabilities. By updating, you reduce the risk of malware exploiting outdated software.
• Be Skeptical of App Requests: Always scrutinize requests for extensive permissions. Malware often asks for control over functions like being set as the default dialer or access to accessibility services under false pretenses. Only grant these permissions if you trust the app completely and understand why it needs them. For example, a photo editing app shouldn’t need the ability to make phone calls or read your screen.

The new and improved FakeCall malware is a reminder that cyber threats are constantly adapting, becoming more complex and harder to detect. What began as a simple scam using fake call screens to mimic banking interactions has now transformed into an advanced tool capable of intercepting calls, recording conversations, and seamlessly integrating with Android systems to mimic user behavior.