An old android malware learns a new trick, disguises itself as Super Mario Run.
Super Mario Run made big news as Nintendo had developed a mobile first game. Unfortunately, the game came to iPhone first, and Android users wishing to get their hands on the game, are still having to wait. Strangely enough, Super Mario Run is showing up available to download for android in some odd places. The problem is, this is not the game, and is instead malware.
The malware is not new. This malware was first discovered back in March of 2013. Named “Marcher”, this malware has been seen in various forms since then. Disguised as android updates, and like now, as popular apps, this this malware tricks users into handing their banking details over to the hackers.
How does it work?
User’s can download the “app” through various means. It can be downloaded from a third party app store, from links in emails or messages, or even from webpages set up specifically to trick people into thinking they are downloading their desired app.
Once installed, the app requests users grant it various permissions, which then allows the app administrative rights to the phone. Once these rights are granted, the app utilizes a false overlay screen to trick users into inputting their banking or credit card information. This information is then delivered directly to the malware orchestrators.
In addition to banking information, Marcher may also use the same tricks to steal social media, email, and website logins.
It’s important to remember that malware such as this is not actually a “hack”. It is instead just an app, that requires users to download it, install it, and grant it the permissions it needs to perform it’s attack.
Users need to use caution when installing apps on their phone. Where is the app coming from? Is it a source you trust? Do the permissions it is requesting seem to be permissions an app of that nature would require? And in cases like Super Mario Run, is the app even available for the platform? If this seems like common sense, it is, and users need to practice it.