GigaBud Rat : Android Banking Trojan Records Screen To Steal Personal Information

A brand-new Android banking Trojan targets customers of financial organizations. The malware, known as Gigabud RAT, has a variety of useful features.

Experts from Group-IB Pavel Naumov and Artyom Grishchenko discussed the danger posed by mobile hackers. According to experts, the Trojan is as follows:

One of the notable features of the Gigabud RAT is that the malicious code is only activated during user authentication. Detection is greatly complicated by this. The Trojan harvests sensitive data through the victim's screen recording rather than by overlaying HTML windows over real apps.

When Cyble experts released a study on the malware in January 2023, the Gigabud RAT first came to public attention. The creators then attempted to pass off their creations as financial and governmental applications. The Gigabud RAT, according to experts, has been in operational since July 2022.

He also has a sibling named Gigabud.Loan, which completely duplicates the malware's functions but does not allow for remote access.

"Users were tricked into completing a bank card application form and offered a loan with a cheap interest rate. Of course, the victim has to disclose personal information, according to the researchers.

Phishing sites are used to spread Gigabud RAT and Gigabud.Loan, and connections to these sites are shared on social media or through SMS messages. The latter, however, might also be available in the WhatsApp messenger as an APK file.

Like other malware in this type, the Trojan first tries to obtain access to the Android operating system's accessibility services. He will be able to capture screenshots and record keystrokes if given these permissions.

Additionally, Gigabud.Loan serves as a tool for gathering personal data, such as full names, the details of bank cards, the images of identification documents, and certificates of education.