Online Threat Alerts (OTA) - Alerting you to scams and frauds.

Malicious App Disguised as a Flash Player That Steals Banking Credentials
Malicious App Disguised as a Flash Player That Steals Banking Credentials

Mobile banking users should be aware of a malicious Android app that steals banking login credentials. The malicious banking app called "Android/Spy.Agent.SI," is a Trojan horse that was created by cyber-criminals, and disguised as a Flash Player to trick potential victims into downloading and installing it. The sophisticated banking Trojan or malware is able to create a fake login screen that will steal the potential victims’ online banking credentials and send it to cyber-criminals. The malicious app also has the ability to intercept SMS or text messages and can therefore, bypass SMS or Text Message two-factor authentication security feature, which was created to prevent access to online users’ accounts, even if their credentials (usernames and passwords) were stolen.

It is important that Android users, who are asked to install Adobe Flash Player, only do so via the Google Play Store.installing Android apps from anywhere else can be dangerous.

Cyber-criminals have created the following malicious websites that have the malicious banking Trojan:

  • www.flashplayeerupdate.com
  • www.adobeflashplaayer.com
  • www.adobeuploadplayer.com
  • www.adobeplayerdownload.com
  • www.adobeupdateplayer.com
  • www.adobeupdateplayeer.com
  • www.adobeupdateflash11.com

The websites above should never be visited since they have the malicious Android file called “FlashPlayer.apk.” The malicious file should never be downloaded or installed. And, Android users should only download apps from the Google Play Store to protect them against malicious apps.

How to Remove the Malicious Banking Android App

In order to remove the malicious app, administrator rights must be disabled or deactivated first. Please see the instructions below:

  • Go to “Settings”
  • Select “Security”
  • Select “Device administrators”
  • Select “Flash Player”
  • Select “Deactivate,” ignore the bogus message and choose “OK”.

If you are prevented from carrying out the instructions above, please restart your mobile device in Safe mode and repeat the instructions above.

Once the administrator rights have been removed, the malicious app can be removed using the following instructions:

  • Go to “Settings”
  • Select “App/Application Manager”
  • Select “Flash Player”
  • Select “Uninstall”
waiting