Evolving Android Banking Malware Targets Iranian Users with Ransomware
A sophisticated Android banking malware, known as deVixor, has been identified as targeting Iranian users through phishing websites masquerading as legitimate automotive businesses. This malware has evolved from a basic SMS-harvesting threat into a fully featured Remote Access Trojan (RAT) that combines banking fraud, credential theft, ransomware, and persistent device surveillance within a single platform. The threat actor has been conducting a mass infection campaign leveraging Telegram-based infrastructure, enabling centralized control, rapid updates, and sustained campaign evolution.
The deVixor malware is distributed as malicious APK files and extensively harvests SMS-based financial information, including OTPs, account balances, card numbers, and messages from banks and cryptocurrency exchanges. It leverages WebView-based JavaScript injection to capture banking credentials by loading legitimate banking pages inside a WebView. The malware includes a remotely triggered ransomware module capable of locking devices and demanding cryptocurrency payments. deVixor uses Firebase for command delivery and Telegram-based bot infrastructure for administration, allowing attackers to manage infections at scale and evade traditional detection mechanisms.
The deVixor Android banking malware poses a significant threat to Iranian users, with the potential for widespread financial loss and compromised personal data. The fact that this malware has evolved to include ransomware capabilities and is being distributed through sophisticated phishing campaigns highlights the need for increased vigilance and robust security measures. Users are advised to exercise caution when downloading APK files from unknown sources and to keep their devices and software up to date with the latest security patches. Cybersecurity professionals should be aware of this threat and take proactive measures to detect and mitigate its impact.
Attack Surface
Endpoint, Mobile Application, Mobile OS
Tactics
Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Exfiltration, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1404 – Access Token Manipulation
- T1414 – Input Capture
SuperPRO's Threat Countermeasures Procedures
- Implement robust security measures, such as multi-factor authentication and encryption, to protect sensitive data.
- Keep devices and software up to date with the latest security patches.
- Use reputable antivirus software to detect and remove malware.
- Exercise caution when downloading APK files from unknown sources.
- Use a secure web browser and keep it up to date with the latest security patches.
- Use a virtual private network (VPN) to encrypt internet traffic.
- Regularly back up important data to a secure location.