Google Authenticator can't keep your 2FA codes safe from

Two-factor authentication or 2FA is a commonly used system to help protect your online accounts. It requires a user to enter an additional code when logging in, which is usually sent through SMS or generated with an app. In general, it is best to use an app to generate the code, such as Google Authenticator, instead of allowing it to be sent over the network to your phone where you run the risk of it being intercepted.

Unfortunately, security researchers from ThreatFabric recently discovered a strain of the Cerberus banking trojan, which can steal 2FA codes from Google Authenticator.

Abusing the Accessibility privileges, the Trojan can now also steal 2FA codes from Google Authenticator application.

When the [Authenticator] app is running, the Trojan can get the content of the interface and can send it to the [command-and-control] server.

In the report, the Dutch mobile security firm said, "We believe that this variant of Cerberus is still in the test phase but might be released soon."

While Cerberus is primarily a banking trojan, the researches note that it now includes many features found in traditional remote access trojans. This would allow users with Cerberus to remotely access your phone and access your bank account, including stealing the 2FA code if needed. It would also allow the attacker to access any other accounts you have enabled two-factor authentication on, such as your email, social media, shopping sites, and more.

Fortunately, for the time being, the Cerberus variant with 2FA stealing capabilities appears to still be in testing, and not out in the wild. Hopefully, by the time it has launched, Google will have found a way to prevent it from accessing two-factor authentication codes.

source androidcentral

Industry: Cyber Security

Volume 0%

Google Authenticator can't keep your 2FA codes safe from this Android malware

Google Authenticator can't keep your 2FA codes safe from this Android malware

Latest Jobs