{"id":37982,"date":"2020-11-02T14:28:03","date_gmt":"2020-11-02T14:28:03","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/31721\/Wroba-Mobile-Banking-Trojan-Targets-US-Smartphones.html"},"modified":"2020-11-02T14:28:03","modified_gmt":"2020-11-02T14:28:03","slug":"wroba-mobile-banking-trojan-targets-us-smartphones","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/wroba-mobile-banking-trojan-targets-us-smartphones\/","title":{"rendered":"Wroba Mobile Banking Trojan Targets US Smartphones"},"content":{"rendered":"
\n
According to details Kaspersky released to the media, the new wave in the U.S. was detected Oct. 29 and targeted users in a variety of U.S. states, including Connecticut, Louisiana and Wisconsin. (Alexxsun\/CC BY-SA 4.0)<\/figcaption><\/figure>\n

Kaspersky\u2019s threat monitoring system has detected a new wave of Wroba trojan activity targeting smartphone users in the United States.<\/p>\n

Until Friday, attacks by the Wroba mobile banking trojan were limited mostly to Asia.<\/p>\n

According to details Kaspersky released to the media, the new wave in the U.S. was detected Oct. 29 and targeted users in a variety of U.S. states, including Connecticut, Louisiana and Wisconsin. The attacks hit both iOS and Android devices.<\/p>\n

The cybercriminals tried to attract users by notifying them of a parcel arrival and a text that said: \u201cYour parcel has been sent out. Please check and accept it.\u201d Next, it took them to a malicious site that shows an alert saying that the user\u2019s browser is out of date and needs updating. Once a user clicks \u201cOK\u201d the malicious app downloads.  <\/p>\n

After the malicious app installs on the user\u2019s mobile device, Wroba can send SMS messages, open web pages, get files from folders related to financial transactions, steal contact lists, call specified numbers and show fake phishing pages to steal the victim\u2019s credentials. Kaspersky products detect the threat as Trojan-Dropper.AndroidOS.Wroba.g.<\/p>\n

Kaspersky researchers say more than 1,000 users faced Trojan-Dropper.AndroidOS.Wroba.g since the start of the year. The countries hit the hardest include Russia, Japan and China. While the U.S. does not sit at the top of the attack list, Kaspersky researchers believe cybercriminals are heading to North America and the number of Wroba infections will increase.<\/p>\n

Hank Schless, senior manager, security solutions at Lookout, said malware delivery attacks like the one Kaspersky reported have become much more common than credential harvesting. He added that according to Lookout data, 88 percent of U.S., consumer phishing attacks so far in 2020 were attempts to deliver malware to a mobile device.<\/p>\n

\u201cTrojans like Wroba pose a significant threat to both consumer and enterprise users,\u201d Schless said. \u201cA mobile trojan can be built to access everything on your device and will not discriminate between personal and corporate data.\u201d<\/p>\n

 Kaspersky recommends following these rules to protect mobile devices:<\/p>\n