Home / Technology / Hidden Malware Steals Logins Via Live Screen Feed
Hidden Malware Steals Logins Via Live Screen Feed
7 May
Summary
- Malware hides icons, blocks removal, and overlays fake login screens.
- Live screen streaming lets attackers monitor activity and capture authentication.
- Four campaigns targeted over 800 banking, crypto, and social media apps.
Four distinct Android banking trojan campaigns—RecruitRat, SaferRat, Astrinox, and Massiv—have been identified by security researchers. These campaigns collectively target more than 800 banking, cryptocurrency, and social media applications, employing increasingly complex installation techniques that rely heavily on user deception. Victims are often lured to fake websites disguised as job portals or streaming services, leading them to sideload malicious software.
Once active, the malware uses Accessibility permissions to monitor user actions and can replace its icon with a blank image, effectively vanishing from the app drawer. Some variants actively prevent uninstallation by redirecting users away from system settings. Beyond overlaying fake banking login screens to harvest credentials, several families transmit live screen content to remote servers, allowing attackers to observe activity and intercept authentication steps in real time. These evolving evasion methods make detection by traditional security tools more challenging.
