DIGITAL LIFE

Godfather malware attacks banking apps on Android devices

A new version of the Godfather malware is worrying digital security experts, as it exploits virtualization techniques to attack banking apps on Android devices. Unlike what is usually associated with virtualization — an extra layer of protection and isolation —, in this case, the technology is used to create isolated environments within the phone itself, making it difficult to detect and allowing malicious operations to be carried out in the background.

Godfather installs itself in the form of an APK that integrates open-source tools such as VirtualApp and Xposed. These tools allow the malware to create an autonomous virtual environment in which it encapsulates legitimate applications, such as banking apps, cryptocurrency apps or online stores. As soon as it identifies one of these applications on the device, Godfather launches it within this controlled environment, being able to observe all the user's actions — from the entry of credentials and PINs to the authorization of transfers.

This method, which is reminiscent of the FjordPhantom attack recorded in 2023, stands out for its scope: Godfather is capable of attacking more than 500 different applications, making it a large-scale threat. By completely virtualizing the file system and masking its intentions, the malware can easily bypass Android's native protections, presenting itself as a legitimate application to the user and security tools.

To make detection even more difficult, Godfather displays fake screens — such as simulated updates or simple black screens — while carrying out its espionage and data theft operations. This sophisticated approach allows the malware to act discreetly, without arousing immediate suspicion.

Although the first samples detected primarily targeted Turkish banking applications, experts warn that this technique could easily be adapted to other markets and regions. The global reach of Android and the ease with which APKs can be spread outside the Play Store increase the risk of this type of threat spreading.

In the face of this new wave of attacks, it is essential that users adopt preventive measures. The main recommendation is to avoid installing applications outside of the Play Store, as these do not undergo the same security checks. In addition, it is essential to pay attention to the permissions requested by applications and be wary of anomalous behavior, such as unexpected update requests or suspicious screens.

The evolution of Godfather shows how attack techniques are increasingly sophisticated, taking advantage of tools originally created to increase security. Constant vigilance and the adoption of good digital practices are, more than ever, essential to protect sensitive data and avoid unpleasant surprises.

mundophone