A new Android trojan has been discovered in Europe that can invisibly monitor encrypted chats and steal data from banking applications. Users who install apps from APK files outside of Google Play are at risk, as such installations are often the entry point for Sturnus.
Sturnus abuses Android access services by obtaining extended permissions that allow it to see everything that happens on the smartphone screen. It does not try to break the encryption of messengers – instead, the Trojan simply captures screen images, including correspondence in WhatsApp, Telegram, Signal, and other applications.
Sturnus infiltrates a device by installing APK files outside of Google Play, after which it is able to monitor the interface, correspondence, and even screen taps. The trojan’s ability to replace banking application screens with HTML overlays is particularly dangerous: the user thinks he or she is entering data into a genuine application, while the login and password are immediately transferred to the attackers. Sturnus can also display fake “Android update” windows, blocking the real interface and masking its activity. Google assures that no known sample of the malware has entered Google Play, and users are protected from known versions of Sturnus by Google Play Protect, which is active by default on devices with Google Play Services.
Although Sturnus is still in its pre-release state, researchers are already assessing it as a fairly sophisticated and flexible tool capable of causing serious damage to banking services and Android users. The main problem is that its key attack vector is the installation of APK files outside the official store. And this factor cannot be completely blocked if the user himself gives permission to do so. There is currently no reliable way to completely eliminate such threats, so the most effective protection is to avoid downloading and installing programs from unknown sources and third-party sites as much as possible.
Sturnus once again reminds us how vulnerable Android devices can be, as the number of them in the world has long since reached a billion. This massive number makes the platform an attractive target for hackers, and an infected smartphone can transmit private data to outsiders, display intrusive ads, and significantly degrade system performance. Moreover, careless installation of a third-party APK can pave the way for malware. That’s why user vigilance and avoidance of dubious sources of app installation remain key security tools in countering new threats like Sturnus.
