PSA: A new Android malware that requests for your selfie!

McAfee Labs Mobile Research Team has recently uncovered a new variant of the infamous Android banking Trojan Acecard, which takes things a step further. The variant actually requests for the victim’s selfie with his identity document!

This variant of Trojan Acecard behaves like most Android banking Trojans as it deceives users into installing the malware by disguising itself as an adult video app or a codec/plug-in that is required to view a specific video. After its successful installation, the malware runs in the background to monitor the opening of specific applications.

In its phishing overlay, it masquerades as Google Play and asks for the user’s credit card details. This variant also targets Singapore and Hong Kong residents as there are instances where the malware asks for HK IDs or Singapore NRIC or passport numbers.

After collecting those information, the Trojan Acecard variant goes a step further to ask the user’s identity confirmation, which comprises three steps. The first two steps will require the victim to upload clear photos of his identity document, both front and back views. The final step will ask the victim for a selfie with his identity document.

The research team warns that such Android banking Trojans are “constantly evolving” to gain as much private information from their victims. In order to prevent such identity and information theft, the team advises Android device owners to exercise caution, especially when installing apps from untrusted sources. The team also warns about divulging too much personal information when prompted by certain applications. Last of all, protect your device with McAfee Mobile Security or other similar apps.

(Source: McAfee Labs)

Our articles may contain affiliate links. If you buy through these links, we may earn a small commission.