Malicious App Targets Major Brazilian Bank Itaú Unibanco
ID: cc5d8b42-d78b-5360-8885-353e93c2450e
STIX ID: report--cc5d8b42-d78b-5360-8885-353e93c2450e
Feed Name: Cyble Blog
Threat Score
An Android banking trojan named 'sincronizador' impersonates Itaú Unibanco via a fake Play Store page and malicious APK (SHA256: 3500c50910c94c7f9bc7b39a7b194bac6137cef586281ee22f5439bb2d140480) hosted at https://acesso.sincronizadorltoken.com/playstore_downloadS34/sincronizador.apk; it requests AccessibilityService permissions to capture input and perform fraudulent transactions against the legitimate Itaú app, uses custom AES/CBC string encryption, and includes MITRE ATT&CK technique mappings and recommended mitigations.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.