Introducing the Android banking malware Vultur – a threat that has evolved with new features to gain greater control over victims’ devices. According to security company NCC Group, this malware now poses an even bigger risk due to its enhanced capabilities.

Initially discovered in 2021, Vultur utilized legitimate software products to access infected devices remotely. It relied on a dropper called Brunhilda, which had been previously used in various Google Play apps to spread malware. However, the latest version of Vultur is not distributed through the Google Play Store and leverages Android’s Accessibility Services for advanced remote control functionalities.

Cybercriminals behind this malware employ a social engineering tactic to trick individuals into installing it. Victims receive an SMS message prompting them to call a number if they suspect an unauthorized transaction. This false sense of urgency leads them to click on a link in another SMS, which appears to be the McAfee Security app but is actually the malicious Brunhilda dropper.

Once Vultur infects a device, threat actors can take complete control by performing various tasks remotely, such as installing/deleting files, scrolling/swiping/clicking, muting/unmuting audio, stopping apps from running, displaying notifications, recording screens, capturing keyboards, and stealing credentials. Banking apps are particularly vulnerable targets for this malware.

Having Vultur on your phone is a nightmare scenario that starts with a simple text message. To avoid falling victim to this malicious scheme, stay vigilant and refrain from panicking if you receive any suspicious SMS about financial transactions. Remember – vigilance is key in protecting your device and personal information from cyber threats like Vultur.