DNS Spoofing  - DNS Spoofing - Android Spyware & Banking Trojan Attack via DNS Spoofing Attack

A new wave of network attacks that uses  and cache poisoning method to distribute XLoader  and Banking Trojan.

DNS Spoofing or poisoning  is a type of cyber-attack that exploits system vulnerabilities in the domain name server to divert traffic away from legitimate servers and directs it towards fake ones

The malicious app poses a legitimate Chrome or Facebook app and it is distributed through fake by pushing a notification to a victim device.

- face - Android Spyware & Banking Trojan Attack via DNS Spoofing Attack

According to TrendMicro analysis report “this new wave of network attacks since early March which for now are targeting Japan, Korea, China, Taiwan, and Hong Kong.

Upon installation, the malicious app is capable of stealing personal information, financial and it installs additional to the device.

It is also capable of hijacking the device and establish persistence through administrator privileges.

How the Infection Work with DNS Spoofing

Attackers compromise the router settings and redirect the traffic to certain websites and fake drive users to the malicious domains and to download XLoader.

Once the application triggered it from the application list and keeps running in the background and triggers the malicious activities.

- xloader android dns spoofing 2 - Android Spyware & Banking Trojan Attack via DNS Spoofing Attack

Trend Micro Researcher says “XLoader creates a provisional web server to receive the broadcast events. It can also create a simple HTTP server on the infected device to deceive victims. It shows a web phishing page whenever the affected device receives a broadcast event (i.e., if a new package is installed or if the device’s screen is on) to steal personal data, such as those keyed in for apps”.

The Phishing page translated to Korean, Japanese, Chinese, or English based on the device language that setup in the device. It is capable of collecting SMS details, records phone calls, steals personal and financial data from the device.

XLoader abuses WebSocket protocol over SSL/TLS to establish persistent and secure communication with C&C server, it also abuses message pack to steal the exfiltrated the data faster.


Setup complex password to routers.
Regularly update the Router & Firewall Firmware.
Monitoring the router’s DNS setting at regular intervals.
Stay wise against social engineering attacks.

Source link


Please enter your comment!
Please enter your name here