Banking Trojans masquerading as Android mobile apps are spreading like wildfire through the smartphones of Korean users, with up to 100,000 devices so far infected.
The Security Research Lab of Cheetah Mobile says the Trojan pretends to be a popular game or tool on one of the many third party Android markets in Korea with the intention of tricking the user into downloading it.
After installation, the virus searches for banking apps on the phone and alerts the user to a bogus update. Once the update is approved, the official app gets deleted and is replaced with a convincing copy. It then asks for the password for the user's security certificate, which is required by the South Korean government in order to access official online services in the country.
The fake app then proceeds to ask for the user's personal banking data - including account numbers, passwords and card security data - before closing with the message "No Wi-Fi connection. Use 3G or try to connect to the W-Fi again." The malware then shuts down the application and proceeds to remove all traces of itself from the device.
More than 2000 variations of the malware have been detected by CM Security researchers, with more than 3000 Korean smartphones infected in the last week alone.