Research firm Pradeo has a warning for Android smartphone users. The security research company recently detected a malicious app called 2FA Authenticator on Google Play store. The app with 10,000-plus users is apparently a trojan-dropper. This means that hackers and cybercriminals use it to secretly install malware on users’ mobile devices. The 2FA Authenticator app is said to inject another malware called Vultur in users’ phones and steal their financial information, including banking and other details. “Our analysis revealed that the dropper automatically installs a malware called Vultur which targets financial services to steal users’ banking information,” says the research report.
The company notified Google about the app and the latter has removed it from Google Play Store. However, while Google removing the app means that there can no longer be anymore victims of the app, the existing users need to delete it from their devices, and they need to do it manually.
How 2FA Authenticator app works
The 2FA Authenticator requests critical permissions that it does not disclose on its Google Play profile. These hidden permissions and the malicious code the app executes enable it to automatically: