Ideally you won’t ever get infected with this hard-to-spot malware. If the user logs in, their credentials are as good as stolen–Marcher sends them off to its C&C server immediately. When a user opens one of over 40 affected apps (Chase, Paypal, Citibank, and even Walmart are among them) Marcher intercepts the login page request and opens a fake one hosted on the internet. SEE: Automated Mobile Application Security Assessment with Mobile Security Framework (TechRepublic Academy) It’s then that Marcher springs into action. It registers the device with a command and control (C&C) server and waits for an unsuspecting user to open a finance app.

This fake Flash version of Marcher operates exactly like older variants. Its code is highly obfuscated, and that makes it even more dangerous–those who have it may have their credentials harvested without ever realizing it. ZScaler’s team goes on to state that less than 20 percent of antivirus software was able to detect this new form of Marcher. How to secure your email via encryption, password management and more (TechRepublic Premium) In security, there is no average behavior Must-read security coverageĨ5% of Android users are concerned about privacyĪlmost 2,000 data breaches reported for the first half of 2022 Opening the APK will prompt the user to disable security and allow installation of third-party apps, at which point the APK installs itself and prepares to steal credentials associated with finance app accounts. Users who open a suspect link will be told they need to update Flash and given the option to download an infected APK file. Researchers at cloud security company ZScaler have discovered a variant of the banking malware Marcher that makes it even more dangerous: It’s lurking on the internet disguised as a Flash update.

Adobe update for mac virus