Android Users Targeted by New Trojan for Financial Frauds and Cyberattacks
The new malware is designed to impersonate an income tax refund that compromises users' privacy and sensitive information.
Alexander 
A new Trojan malware has been spotted to attack customers of Indian banks via their Android phones. According to Indian Computer Emergency Response Team (CERT-In), the malware has been attacked by now customers of more than 27 private and public sector banks, says ABP Live.
CERT-In explained that the new malware poses as an income tax refund, that is able to affect the privacy of sensitive customers' data and open the door for financial frauds and major cyberattacks.
The response team added "Drinik started as a primitive SMS stealer back in year 2016 and has evolved recently to a banking Trojan that demonstrates phishing screen and persuades users to enter sensitive banking information,"
This federal agency is the one that is in charge of protecting Indian cyberspace against dangerous internet software, hacker attacks, and other similar activities. The CERT-In organization has published a warning that details the attack method and how customers might be protected against it.
For the victim to begin the verification procedure, an SMS is sent to him or her containing a link to the infected APK file. When a customer is ready to complete the procedure, they can supply their personal information. This webpage appears to be a good copy of the website for the Income Tax Department.
The malware is advanced enough to commit financial fraud
CERT-In advisory notes "This malicious android app masquerades as the Income Tax Department app and after installation, the app asks the user to grant necessary permissions like SMS, call logs, contacts etc," [...] "If the user does not enter any information on the website, the same screen with the form is displayed in the android application and the user is asked to fill in to proceed,"
The details required to be input include a personal identification number (PAN), an Aadhaar number, and address, a date of birth, a mobile number, an email address, an IFSC code, a debit card number, and a credit card verification value (CVV).
The program presents an error message when the user enters the amount and clicks "Transfer", therefore displaying a bogus update screen.
