Back

"In The Box" - Mobile Malware Webinjects Marketplace

Cybercrime Intelligence

Mobile, Malware, Dark Web, webinjects, Financial Institutions, Cybercriminals

"In The Box" - Mobile Malware Webinjects Marketplace

With the rapid growth of fraudulent activity in a post-pandemic world, the bad actors continue to upgrade their tooling to attack customers of major financial institutions (FIs), e-commerce platforms and online marketplaces. According to collected statistics in Q4 2022 during DFIR engagements conducted on Fortune 500 companies by Resecurity®, cybercriminals are especially successful when attacking mobile apps and leveraging gained access for further unauthorized access and financial theft. Unless FIs implement various technologies to combat fraud, this vector remains relatively unprotected which provides threat actors enough flexibility to bypass fraud detection systems by ultimately controlling the victim's mobile device. Once the mobile device of the victim has been compromised, the bad actors can intercept OTP codes, incoming SMS messages, and phone calls to extract sensitive information including call history and contact lists. Besides other concerning types of threats such as "SIM Swapping" also widely used by fraudsters, mobile malware remains the key in a cybercriminals arsenal to conduct banking theft from consumers worldwide.

This research arranged by Resecurity® Hunter team is focused on the new marketplace called “InTheBox”, recently emerged in the Dark Web and designed specifically for mobile malware operators. The first mentions of “InTheBox” were identified on reputable underground communities around January 2020 - since that time the key actor was offering webinjects development services for other cybercriminals privately, but after gaining enough credibility the actor scaled it to a fully productized automated marketplace. The automation allows other bad actors to create orders to receive the most up to date webinject for further implementation into mobile malware. For those using proprietary (or so called “private”), mobile malware is not widely available for sale or rent, because of this “InTheBox” is offering customized development solutions. As of today, the most widely malware families supporting webinjects are - Alien, Cerberus, Ermac, Hydra, Octopus (aka “Octo”), Poison, and MetaDroid.

The marketplace is available in TOR network:


inthebox login page dark web shop



As an OPSEC measure, the administrator of the marketplace also requires vetting of new customers:


vetting dark web shop inthebox access



After the successful account activation, the marketplace will offer listing of available webinjects for sale:




It is worth mentioning how almost all of them may be used for credential interception from any service the victim may attempt to access while using their mobile device besides online-banking. The bad actor may then use the data stolen from said devices for any malicious purposes. To facilitate successful credentials interception, the bad actors use a so called "Webinjects" - customized modules or packages used in malware that typically inject HTML or JavaScript code into content before it's rendered on a web browser. As a result, webinjects can alter what the user sees on his/her browser, as opposed to what's in fact being sent by the server.

Typically, malware developers design code to intercept victims credentials using such approach which in practice looks completely invisible visually, as the webinject will interpret an identical design of legitimate pages from popular services. Technically, the success rate of banking theft depends on the quality of the webinject and stability of mobile malware. During past years, the market of mobile banking malware became extremely mature, and the majority of Dark Web actors stopped selling it, they switched to potentially renting, or to privately us it.

Examples of webinjects:


example webinjects andorid malware



There are multiple underground vendors developing webinjects - tracking the latest design and updates of legitimate mobile apps makes their attacks extremely efficient. The price on webinjects is typically lower than mobile malware itself and varies between 50$ and 200$ per inject depending how popular the FI is. Typically, it also includes basic support and possible customization in case the mobile app changes. The price range on mobile malware varies and with the recent shift to rent and private operations, the inject may exceed 5,000$ per month or leveraged commission-based model with payouts from successful thefts shared between malware operator and developers.

Just recently “InTheBox” implemented a new tariff called “unlim” allowing cybercriminals to generate unlimited number of webinjects during the subscription period. Such model allows to minimize manual and human interactions with the marketplace operators, simplifying malware customization processes.


injection panel malicious tool webinject inthebox



Based on the chosen plan other malware operators can create orders on the injects or customized development. Their feedback and order status will be available via the portal:


customized injection malware inthebox webinject malicious threat actor



The bad actor known as "inthebox" launched a new webinjects marketplace on the TOR network. The marketplace provides different templates of webinjects for various mobile malware families which are used independently or in combination to successful execute data theft:

  • Template “Authorization data”
  • Template “Ask only PIN”
  • Template “With Credit Card data”
  • Template “With Credit Card data + ATM PIN”
  • Template “Ask Full Data”




Today, “InTheBox” provides access to over 400 professionally developed webinjects categorized by geography and target:










The majority of high-demand injects is related to payment services including digital banking and cryptocurrency exchangers. During November 2022 the actor arranged a significant update of close to 144 injects improving their visual design.


Payment Systems List


Luno:
co.bitx.android.wallet

Bitfinex:
com.bitfinex.mobileapp

BitPay - Buy Crypto:
com.bitpay.wallet

Buy Bitcoin & Crypto Exchange:
com.changelly.app

Coinbase: Buy Bitcoin & Ether:
com.coinbase.android

Luno:
co.bitx.android.wallet

Bitfinex:
com.bitfinex.mobileapp

BitPay - Buy Crypto:
com.bitpay.wallet

Buy Bitcoin & Crypto Exchange:
com.changelly.app

Coinbase: Buy Bitcoin & Ether:
com.coinbase.android

Gemini: Buy Bitcoin & Crypto:
com.gemini.android.app

HitBTC – Cryptocurrency Exchange & Trading BTC App:
com.hittechsexpertlimited.hitbtc

HuobiWallet:
com.huobionchainwallet.gp

Kraken Pro: Advanced Bitcoin & Crypto Trading:
com.kraken.trade

PayPal - Send, Shop, Manage:
com.paypal.android.p2pmobile

Wise, ex TransferWise:
com.transferwise.android

Bitstamp – Crypto on the go:
net.bitstamp.app

Electrum Bitcoin Wallet:
org.electrum.electrum

BtcTurk | PRO Trade Bitcoin & Cryptocurrency:
com.btcturk.pro

Electroneum:
com.electroneum.mobile

Enjin: Bitcoin, Ethereum, NFT Crypto Wallet:
com.enjin.mobile.wallet

KuCoin: BTC, Crypto exchange:
com.kubi.kucoin

Lumi Crypto Bitcoin Wallet:
com.lumiwallet.android

BtcTurk | Bitcoin (BTC) Al Sat:
com.mobillium.btcturk

Mycelium Bitcoin Wallet:
com.mycelium.wallet

Okcoin - Buy Bitcoin, Ethereum, Shiba Inu, Crypto:
com.okinc.okcoin.intl

OKEx:Buy Bitcoin, NFTs & Meta:
com.okinc.okex.gp

Paribu | Bitcoin-Kripto Para Alım Satım:
com.paribu.app

Poloniex Crypto Exchange:
com.plunien.poloniex

Samourai Wallet (Early Access):
com.samourai.wallet

TabTrader Buy Bitcoin and Ethereum on exchanges:
com.tabtrader.android

Contasimple - Invoices, estimates & delivery notes:
com.v2msoft.contasimple

Waves.Exchange:
com.wavesplatform.wallet

WazirX - Bitcoin, Crypto Trading Exchange India:
com.wrx.wazirx

BitGlobal (formerly Bithumb Global):
global.bithumb.android

Indodax:
id.co.bitcoin

Bitcoin Wallet by SpectroCoin:
lt.spectrofinance.spectrocoin.android.wallet

Zonda - crypto exchange:
net.bitbay.bitcoin

MetaMask - Buy, Send and Swap Crypto:
io.metamask

Crypto.com - Buy BTC, ETH:
co.mona.android

Binance: BTC NFTs Memes & Meta:
com.binance.dev

Trust: Crypto & Bitcoin Wallet:
com.wallet.crypto.trustapp

Blockchain.com Wallet: Buy BTC:
piuk.blockchain.android

Coinbase Wallet - Store Crypto:
org.toshi

Bitcoin Wallet: buy BTC, BCH & ETH:
com.bitcoin.mwallet

Cash App:
com.squareup.cash


e-Commerce List


AutoScout24 Schweiz – Finden Sie Ihr neues Auto:
ch.autoscout24.autoscout24

Amazon Seller:
com.amazon.sellermobile.android

Tide: Business Bank Account:
com.tideplatform.banking

mobile.de - car market:
de.mobile.android.app

Amazon Shopping:
com.amazon.mShop.android.shopping

SHEIN-Fashion Shopping Online:
com.zzkko

noon shopping:
com.noon.buyerapp

Alibaba.com:
com.alibaba.intl.android.apps.poseidon

Lulu Shopping:
com.lulu.commerce


Social List


Instagram:
com.instagram.android

WhatsApp Messenger:
com.whatsapp

Facebook:
com.facebook.katana

Tinder - Dating & Make Friends:
com.tinder

ZOOM Cloud Meetings:
us.zoom.videomeetings

Facebook Messenger:
com.facebook.orca


Digital Media List


Netflix:
com.netflix.mediaclient

Spotify: Music and Podcasts:
com.spotify.music



The marketplace has also region-specific categories with a strong focus on the U.S. and U.K. businesses, online-services and financial institutions:


United States List


Citi Mobile®:
com.citi.citimobile

E*TRADE:
Invest. Trade. Save.:
com.etrade.mobilepro.activity

Invoice Maker:
Easy & Simple:
com.aadhk.woinvoice

Airbnb:
com.airbnb.android

Amex:
com.americanexpress.android.acctsvcs.us

AOL - News, Mail & Video:
com.aol.mobile.aolapp

myAT&T:
com.att.myWireless

U by BB&T:
com.bbt.myfi

Citizens Bank Mobile Banking:
com.citizensbank.androidapp

Discover Mobile:
com.discoverfinancial.mobile

Bank of America Mobile Banking:
com.infonow.bofa

KeyBank - Online & Mobile Banking:
com.key.android

LinkedIn:
com.linkedin.android

First Citizens Mobile Banking:
com.mcom.firstcitizens

M&T Mobile Banking:
com.mtb.mbanking.sc.retail.prod

Schwab Mobile:
com.schwab.mobile

TD Bank (US):
com.tdbank

UBS Mobile Banking:
com.ubs.swidKXJ.android

USAA Mobile:
com.usaa.mobile.android.usaa

Woodforest Mobile Banking:
com.woodforest

SECU:
org.ncsecu.mobile

Ally Mobile:
Banking & Investing:
com.ally.MobileBanking

BMO Digital Banking:
com.bmoharris.digital

Booking.com:
Hotels and more:
com.booking

Bank of the West Mobile:
com.botw.mobilebanking

Chase Mobile:
com.chase.sig.android

Fifth Third Mobile Banking:
com.clairmail.fth

Compass Savings Bank:
com.compasssavingsbank.mobile

Capital One Mobile:
com.konylabs.capitalone

Morgan Stanley Wealth Mgmt:
com.morganstanley.clientmobile.prod

Navy Federal Credit Union:
com.navyfederal.android

PNC Mobile:
com.pnc.ecommerce.mobile

SunTrust Mobile App:
com.suntrust.mobilebanking

Wells Fargo Mobile:
com.wf.wellsfargomobile

Zelle:
com.zellepay.zelle

Robinhood:
Stocks & Crypto:
com.robinhood.android

eToro:
com.etoro.openbook

I am Verizon:
com.dynamicsignal.enterprise.iamvz

One Talk Side View:
com.verizon.sideview

One Talk:
com.verizon.onetalk

Verizon Messages:
com.verizon.messaging.vzmsgs

Verizon ID:
com.verizon.verizonidauth

Inside Verizon:
com.verizon.insideverizon

Verizon Smart Family:
com.verizon.familybase.parent

myMetro:
com.nuance.nmc.sihome.metropcs

Truist Mobile:
com.truist.mobile

Regions Bank:
com.regions.mobbanking

Huntington Mobile:
com.huntington.m

U.S. Bank Mobile:
Bank and Invest:
com.usbank.mobilebanking

Santander Bank US:
com.sovereign.santander

First Horizon Events:
com.aventri.firsthorizonbank300005742

FNB Direct:
com.FNBPA.mobilebanking

BancorpSouth Mobile:
com.bancorpsouth.android

Found — Banking & Taxes:
app.indie.my

MOVO ON-DEMAND MOBILE BANKING:
com.movocash.movo

MoneyLion:
Bank & Finance App:
com.moneylion

Albert:
Banking on you:
com.meetalbert

Dave - Banking & Cash Advance:
com.dave

Douugh:
com.douugh.douughapp

Current:
The Future of Banking:
com.current.app


United Kingdom List


Lloyds Bank Mobile Banking:
com.grppl.android.shell.CMBlloydsTSB73

Halifax Mobile Banking:
com.grppl.android.shell.halifax

Bank of Scotland Mobile Banking:
com.grppl.android.shell.BOS

Nationwide Banking App:
co.uk.Nationwide.Mobile

The Co-operative Bank:
com.cooperativebank.bank

permanent tsb:
com.nearform.ptsb

HSBC UK Mobile Banking:
uk.co.hsbc.hsbcukmobilebanking

Santander Mobile Banking:
uk.co.santander.santanderUK

TSB Mobile Banking:
uk.co.tsb.newmobilebank

Barclays US Credit Cards:
com.barclaycardus

NatWest Mobile Banking:
com.rbs.mobile.android.natwest

Royal Bank of Scotland:
com.rbs.mobile.android.rbs

TSB Bank Mobile Banking:
tsb.mobilebanking

MBNA Card Services App:
uk.co.mbna.cardservices.android

Metro Bank:
uk.co.metrobankonline.mobile.android.production

Tesco Mobile:
uk.co.tescomobile.android

Capital One UK:
com.ie.capitalone.uk

Revolut:
com.revolut.revolut

Deliveroo:
Food Delivery:
com.deliveroo.orderapp

Monzo - Mobile Banking:
co.uk.getmondo

Revolut Business:
com.revolut.business

Cashplus Bank - business & per:
co.uk.mycashplus.maapp

ANNA Business Account & Tax:
com.anna.money.app

Chase UK:
com.chase.intl

Coutts:
com.coutts.model.prod.tadpole

C. Hoare & Co.:
com.mobile.CHoareCo

Nexo:
купи BTC, ETH, SOL, AVAX:
com.nexowallet

Coutts Mobile:
com.rbs.mobile.android.coutts

Soldo:
com.soldo.business.next

Pleo:
io.pleo.android

Amex United Kingdom:
com.americanexpress.android.acctsvcs.uk

Proton Mail:
Encrypted Email:
ch.protonmail.android

BT Email:
com.bt.mail.btprod

SumUp:
com.kaching.merchant

Lloyds Bank Business:
com.lloydsbank.businessmobile

Business Banking:
uk.co.santander.businessUK.bb


Besides the U.S. and the U.K. as 2 major geographies to target consumers, “InTheBox” provides webinjects for online-services and financial institutions from over 28 countries including Andorra, Argentina, Austria, Australia, Belgium, Brazil, Canada, Chile, Colombia, Germany, Denmark, Spain, France, Georgia, Greece, Hungary, Italy, Japan, Mexico, Malaysia, Nigeria, Peru, Poland, Portugal, Qatar, Romania, Turkey, United Arab Emirates and Saudi Arabia.

The full list of other injects for sale porovided below:


Andorra List


Andbank:
air.com.inversis.AndbankSmartphone

MoraBanc:
com.morabanc.mobileapp

Crèdit Andorrà:
com.creditandorra

BSA Mòbil:
com.everis.bsa_1_3


UAE List


Burgan Bank:
com.a2a.android.burgan

SNB AlAhli Mobile:
com.alahli.mobile.android

alrajhi bank:
com.alrajhiretailapp

RiyadBank Mobile:
com.riyadbank.strategic

CBD - Instant digital banking:
com.cbd.mobile

ADCB:
com.adcb.bank

Ajman Bank:
com.mbanking.ajmanbank

Al Hilal Mobile Banking App:
com.infosys.alh

MBank UAE:
com.mbankuae.amcb

Al Masraf:
ae.almasraf.mobileapp

eBOS Mobile:
com.ebos.bos

CBQ Mobile:
com.cbq.CBMobile

DIB MOBILE:
com.dib.app

FAB Mobile:
com.fab.personalbanking

Finance House App:
com.fh.payday

NBQBANK:
com.NBQBank

RAKBANK Digital Banking:
com.rak

SC Mobile Banking (UAE):
com.scb.ae.bmw

SIB Digital:
com.sib.retail

United Arab Bank Mobile:
com.uab.personal

NBF Direct App:
com.vipera.nbf

Mashreq UAE:
com.vipera.ts.starter.MashreqAE

Emirates NBD:
enbd.mobilebanking

EI Bank:
com.s4m

Al Hilal Digital:
ae.ahb.digital

C3Pay:
com.myc3card.app

ADIB Mobile Banking App:
com.adib.mobile

Mashreq Neo - Bank easy:
com.mashreq.NeoApp

ADCB Hayyak:
Start your banking relationship now!:
com.adcb.cbgdigi

Liv. - Digital Lifestyle Bank:
com.liv.android

ENBD X:
com.emiratesnbd.android

YAP – Your Digital Banking App:
com.yap.banking

AAIB Mobile:
com.aaib

Arabi-Mobile:
com.arabbank.arabimobilev2

Dubai First:
com.bankfab.pbg.ae.dubaifirst

HSBC UAE:
ae.hsbc.hsbcuae

eWalletAE:
com.etisalat.ewallet

Alfa by Bank Alfalah:
com.base.bankalfalah

Citibank UAE:
com.citibank.mobile.citiuaePAT

KFC UAE (United Arab Emirates):
com.kfc.me

Snoonu - Fastest Delivery:
com.oryx.snoonu

Namshi - Shop Fashion & Beauty:
com.namshi.android

MAF Carrefour Online Shopping:
com.aswat.carrefouruae

السوق المفتوح - OpenSooq:
com.opensooq.OpenSooq

Shail:
de.hafas.android.dimp

Fordeal - فورديل سوق الانترنت:
com.fordeal.android

PizzaHut UAE:
com.pizzahutapp

Simplylife from ADCB:
com.adcb.simplylife


Argentina List


Santander Argentina:
ar.com.santander.rio.mbanking

Patagonia Móvil:
ar.com.bcopatagonia.android

Credicoop Móvil:
coop.bancocredicoop.bancamobile

Banca Móvil Ciudad:
ar.com.redlink.custom

Macro:
ar.macro

Bip Móvil:
ar.bapro


Austria List


Bank Austria MobileBanking:
com.bankaustria.android.olb

easybank App:
com.easybank.easybank

George Österreich:
at.erstebank.george

bank99:
at.ing.diba.client.onlinebanking

Mein ELBA-App:
at.rsg.pfp

BAWAG PSK klar – Mobile Banking App:
com.bawagpsk.bawagpsk

HYPO Mein ELBA-App:
com.isis_papyrus.hypo_pay_eyewdg

Volksbank hausbanking:
at.volksbank.volksbankmobile

meine99 | Online Banking:
at.bank99.meine.meine

S-pushTAN für Smartphone und Tablet:
com.starfinanz.mobile.android.pushtan

Digital Banking App:
at.aerztebank.aerztebankmobile

Anadi Internetbanking:
at.anadi.mobilebanking


Australia List


My AMP:
au.com.amp.myportfolio.android

Bankwest:
au.com.bankwest.mobile

CommBiz:
au.com.commbank.commbiz.prod

Great Southern Bank Australia:
au.com.cua.mb

HSBC Australia:
au.com.hsbc.hsbcaustralia

Macquarie Mobile Banking:
au.com.macquarie.banking

ME Bank:
au.com.mebank.banking

NAB Mobile Banking:
au.com.nab.mobile

NPBS Mobile Banking:
au.com.newcastlepermanent

myRAMS:
au.com.rams.RAMS

Suncorp Secured:
au.com.suncorp.rsa.suncorpsecured

UBank:
au.com.ubank.internetbanking

Virgin Money Credit Card:
com.virginmoney.cards

Bank of Melbourne Business App:
org.banking.bom.businessconnect

BankSA Business App:
org.banking.bsa.businessconnect

St.George Business App:
org.banking.stg.businessconnect

BankSA Mobile Banking:
org.banksa.bank

Bank of Melbourne Mobile Banking:
org.bom.bank

St.George Mobile Banking:
org.stgeorge.bank

Westpac:
org.westpac.bank

Westpac Corporate Mobile:
org.westpac.col

Zip - Shop Now, Pay Later:
co.zip

BOQ Mobile:
com.bankofqueensland.boq

Bendigo Bank:
com.bendigobank.mobile

CommBank:
com.commbank.netbank

Bank Australia app:
com.fusion.banking

Beyond Bank Australia:
com.fusion.beyondbank

Beyond Bank Australia:
com.greater.Greater

HSBCnet Mobile:
com.hsbc.hsbcnet


Belgium List


ING Banking:
com.ing.banking

Argenta Bankieren:
be.argenta.bankieren

Mobile Banking Service:
be.axa.mobilebanking

Belfius Mobile:
be.belfius.directmobile.android

Beobank Mobile:
com.beobank_prod.bad

Easy Banking App:
com.bnpp.easybanking

KBC Mobile:
com.kbc.mobile.android.phone.kbc


Canada List


Banco next:
Conta e Cartão:
br.com.bradesco.next

Inter:
Pix, Cartão e Conta:
br.com.intermedium

banco digital modalmais - conta e corretora online:
br.com.modalmais

Original - Pix, Digital, Cashback e Empréstimos:
br.com.original.bank

PagBank:
Banco, Conta digital, Cartão, Pix, CDB:
br.com.uol.ps.myaccount

Banco Bradesco:
com.bradesco

Banco Itaú:
com.itau


Digital Media List


National Bank of Canada:
ca.bnc.android

HSBC Canada:
ca.hsbc.hsbccanada

Manulife Mobile:
ca.manulife.MobileGBRS

PC Financial Mobile:
ca.pcfinancial.bank

Tangerine Mobile Banking:
ca.tangerine.clients.banking.app

CIBC Mobile Banking®:
com.cibc.android.mobi

Services mobiles Desjardins:
com.desjardins.mobile

RBC Mobile:
com.rbc.mobile.android

TD Canada:
com.td

Affinity Mobile:
ca.affinitycu.mobile

motusbank mobile banking:
ca.motusbank.mapp

Servus Mobile Banking:
ca.servus.mbanking

ATB Personal - Mobile Banking:
com.atb.ATBMobile

ATB Business - Mobile Banking:
com.atb.businessmobile

Coast Capital Savings:
com.coastcapitalsavings.dcu

EQ Bank Mobile Banking:
com.eqbank.eqbank

Meridian Mobile Banking:
com.meridian.android

Simplii Financial:
com.pcfinancial.mobile

Vancity:
com.vancity.mobileapp

Scotiabank Mobile Banking:
com.scotiabank.banking

BMO Mobile Banking:
com.bmo.mobile

Capital One Canada:
ca.capitalone.enterprisemobilebanking

Indeed Job Search:
com.indeed.android.jobsearch

com.eqbank.eqbank (NEW)

com.shaketh (NEW)

ca.hsbc.hsbccanada (NEW)

ca.manulife.MobileGBRS (NEW)

com.meridian.android (NEW)

affinitycu.mobile (NEW)

com.atb.ATBMobile (NEW)

com.atb.businessmobile (NEW)


Chile List


Banco Falabella | CMR:
cl.android

Mercado Libre: Compras Navidad:
com.mercadolibre

Mercado Pago: cuenta digital:
com.mercadopago.wallet


Colombia List


Banco de Bogotá:
com.bancodebogota.bancamovil

Banco de Occidente Móvil:
com.grupoavaloc1.bancamovil

Davivienda Móvil:
com.todo1.davivienda.mobileapp

Bancolombia Personas:
com.todo1.mobile

Scotiabank Colpatria:
eu.netinfo.colpatria.system

BBVA Colombia:
co.com.bbva.mb

Banco Agrario App:
co.com.bancoagrario.icbanking

Banco Falabella Colombia:
co.com.bancofalabella.mobile.omc

Banca Móvil BAC Credomatic:
net.bac.sbe.android


Germany List


La Mia Banca:
com.db.pbc.miabanca

Sparkasse Ihre mobile Filiale:
com.starfinanz.smob.android.sfinanzstatus

Commerzbank Banking - Die App an Ihrer Seite:
de.commerzbanking.mobil

VR Banking Classic:
de.fiducia.smartphone.android.banking.vr

ING Banking to go:
de.ingdiba.bankingapp

Santander Banking:
de.santander.presentation

traktorpool:
de.traktorpool

comdirect:
de.comdirect.app

N26 — The Mobile Bank:
de.number26.android

Postbank Finanzassistent:
de.postbank.finanzassistent

SpardaSecureApp:
de.sdvrz.ihb.mobile.secureapp.sparda.produktion

HVB Mobile Banking:
eu.unicreditgroup.hvbapptan

SpardaApp:
de.sdvrz.ihb.mobile.app

Sparda Berlin:
de.spardab.banking.privat

Postbank BestSign:
de.postbank.bestsign

Consorsbank:
de.consorsbank

Volksbank · Banca Popolare:
it.volksbank.android

Denmark List


Mobilbank DK – Danske Bank:
com.danskebank.mobilebank3.dk

Nordea Mobile - Danmark:
dk.nordea.mobilebank


Spain List


BBVA España | Banca Online:
com.bbva.bbvacontigo

Caja de Ingenieros Banca MÓVIL:
com.cajaingenieros.android.bancamovil

Cajasur:
com.cajasur.android

Banco Mediolanum España:
com.mediolanum

Tomamos impulso - TARGOBANK I AGRUPACIÓ I ATLANTIS:
com.targoes_prod.bad

ABANCA - Banca Móvil:
es.caixagalicia.activamovil

Caixa Ontinyent:
es.caixaontinyent.caixaontinyentapp

Ibercaja:
es.ibercaja.ibercajaapp

Pibank:
es.pibank.customers

Banco Caja Social Móvil:
com.bancocajasocial.geolocation

imagin – Más que una app para gestionar tu dinero:
com.imaginbank.app

Bankinter Móvil:
com.bankinter.launcher

BBVA Empresas | ES & PT:
com.bbva.netcash

Grupo Cajamar:
com.grupocajamar.wefferent

Go ABANCA:
com.indra.itecban.mobile.novobanco

Triodos Bank. Banca Móvil:
com.indra.itecban.triodosbank.mobile.banking

Kutxabank:
com.kutxabank.android

Colonya Caixa Pollença:
com.rsi.Colonya

ruralvia:
com.rsi

Banca Móvil Laboral Kutxa:
com.tecnocom.cajalaboral

Santander:
es.bancosantander.apps

Santander Empresas:
es.bancosantander.empresas

UniPay Unicaja:
es.cecabank.ealia2103appstore

EVO Banco móvil:
es.evobanco.bancamovil

bank – banca móvil:
es.openbank.mobile

Criptocalculadora:
es.santander.Criptocalculadora

Unicaja Banco:
es.unicajabanco.app

AV Villas App:
com.grupoavalav1.bancamovil

Orange Bank - Banco Móvil:
es.orangebank.app

Banco Sabadell App. Your mobile bank:
net.inverline.bancosabadell.officelocator.android

CaixaBankNow:
es.lacaixa.mobile.android.newwapicon

ING España. Banca Móvil:
www.ingdirect.nativeframe

Tarjeta prepago de correos:
com.correosprepago

Carrefour PASS Móvil:
com.carrefour.carrefourPass

El Corte Inglés:
com.elcorteingles.app

Tarjeta El Corte Inglés:
com.feci.apps


France List


Boursorama Banque:
com.boursorama.android.clients

Banxo:
com.caisseepargne.android.mobilebanking

CIC:
com.cic_prod.bad

Crédit Mutuel:
com.cm_prod.bad

La Banque Postale:
com.fullsix.android.labanquepostale.accountaccess

LAppli Société Générale:
mobi.societegenerale.mobile.lappli

AXA Banque France:
com.axabanque.fr

Crédit Coopératif:
com.credit_coop.android.mobilebanking

Mon Epargne Salariale:
com.mootwin.natixis

Crédit du Nord pour Mobile:
com.ocito.cdn.activity.creditdunord

Hello bank! par BNP Paribas:
fr.bnpp.digitalbanking

Ma Banque Entreprise:
fr.bnpparibasentreprise.android

BRED:
fr.bred.fr

Ma Banque:
fr.creditagricole.androidapp

HSBC France:
fr.hsbc.hsbcfrance

Mes Comptes - LCL:
fr.lcl.android.customerarea

Pro & Entreprises LCL:
fr.lcl.android.entreprise

Mes Comptes BNP Paribas:
net.bnpparibas.mescomptes

Banque Laydernier - Mobile:
com.ocito.cdn.activity.banquelaydernier

Caf - Mon Compte:
fr.cnaf.mobile.moncompte

CMB ma banque :
solde, virement & épargne:
com.arkea.android.application.cmb

Banque Populaire:
fr.banquepopulaire.cyberplus

BforBank :
la banque en ligne:
com.bforbank.androidapp

Fortuneo, banque & bourse:
com.fortuneo.android

Monabanq:
com.mona_prod.bad

Shine - Compte pro en ligne:
com.shine.app

Qonto • Business Finance App:
eu.qonto.qonto

Nickel - Compte pour tous:
com.fpe.comptenickel


Georgia List


Cartu Bank Mobile:
com.mobius.mobilebank.cartu

ProCredit Bank myDirect:
com.pcb.mydirect

BOG mBank - Mobile Banking:
ge.bog.mobilebank

Liberty:
ge.lb.mobilebank

BasisBank:
ge.mobility.basisbank

eMoney:
ge.mobility.emoney

Terabank mBank - Mobile Banking:
mobility.ge.terabank


Greece List


Eurobank Mobile App:
com.EurobankEFG

myAlpha Mobile:
com.mobileloft.alpha.droid

AstroBank Mobile Banking:
gr.winbank.mobile.cyprus

Attica Mobile:
eu.afse.omnia.attica

NBG Mobile Banking:
mbanking.NBG

Winbank Mobile:
gr.winbank.mobilenext


Hungary List


OTP SmartBank:
com.aff.otpdirekt

myRaiffeisen mobile app:
com.rbinternational.retail.mobileapp

UniCredit mBanking:
hr.asseco.android.jimba.mUCI.hu

Budapest Bank Mobil App:
hu.bb.mobilapp

CIB Business Online:
hu.cardinal.cib.mobilapp

Erste Business MobilBank:
hu.cardinal.erste.mobilapp

K&H mobilbank:
hu.khb

MKB Mobilalkalmazás:
hu.mkb.mobilapp

OTP Bank HU:
hu.otpbank.mobile

George Magyarország:
pegasus.project.ebh.mobile.android.bundle.mobilebank

VÚB Mobile Banking:
sk.vub.mobile

com.aff.otpdirekt

com.rbinternational.retail.mobileapp

hr.asseco.android.intesa.isbd.cib

hr.asseco.android.jimba.mUCI.hu

hu.bb.mobilapp

hu.cardinal.cib.mobilapp

hu.cardinal.erste.mobilapp

hu.khb

hu.mkb.mobilapp

hu.otpbank.mobile

pegasus.project.ebh.mobile.android.bundle.mobilebank


India List


Cent Mobile:
com.infrasofttech.CentralBank

Maha Mobile:
com.infrasofttech.MahaBank

Dhanlaxmi Bank Mobile Banking:
com.dhanlaxmi.dhansmart.mtc

Kotak - 811 & Mobile Banking:
com.msf.kbank.mobile

Yono Business:
com.sbi.SBAnywhereCorporate

HDFC Bank MobileBanking App:
com.snapwork.hdfc

PNB ONE:
com.Version1

iMobile Pay by ICICI Bank:
com.csam.icici.bank.imobile

Paytm:
Secure UPI Payments:
net.one97.paytm

FinShell Pay:
com.finshell.fin

IPPB Mobile Banking:
com.iexceed.appzillon.ippbMB

SBI Card:
com.ge.capital.konysbiapp

Bajaj Finserv Wallet:
com.mobikwik_new.bajajfinserv

RBL MyCard:
com.rbl.rblmycard

Federal Bank - FedMobile:
com.fedmobile

IDFC FIRST Bank:
MobileBanking:
com.idfcfirstbank.optimus


Italy List


BancoPosta:
posteitaliane.posteapp.appbpol

YouApp:
com.lynxspa.bancopopolare

BNL:
it.bnl.apps.banking

Carige Mobile:
it.carige

UBI Banca:
it.nogood.container

SCRIGNOapp:
it.popso.SCRIGNOapp

Postepay:
posteitaliane.posteapp.apppostepay

Intesa Sanpaolo Mobile:
com.latuabancaperandroid

Sella:
com.sella.BancaSella

myCartaBCC:
it.bcc.iccrea.mycartabcc

Banca MPS:
it.copergmps.rt.pf.android.sp.bmps

Bancaperta:
it.creval.bancaperta

Mobile Banking UniCredit:
com.unicredit

CheBanca!:
com.vipera.chebanca

Nexi Pay:
it.icbpi.mobile

Hype:
it.hype.app

Mediolanum:
com.mediolanum.android.fullbanca


Mexico List


SuperMóvil:
mx.bancosantander.supermovil

Bi en Línea:
gt.com.bi.bienlinea

Banorte Móvil:
org.microemu.android.model.common.VTUserApplicationBNRTMB

Banca Mifel:
com.mifel.mobile.activity

Bajionet Móvil Empresarial:
mx.com.bb.b2

Banco Sabadell Méx. Tu Ahorro:
mx.bancsabadell.part

BBVA México:
com.bancomer.mbanking

ScotiaMóvil MX:
com.scotiabankmx.scotiamovil

HSBC México:
mx.hsbc.hsbcmexico

BBVA Empresas México:
com.bbva.GEMA

Bajionet Móvil:
org.microemu.android.model.common.VTUserApplicationBNBJMB


Malaysia List


SC Mobile Malaysia:
air.app.scb.breeze.android.main.my.prod

AmOnline:
com.ambank.ambankonline

CIMB Clicks Malaysia:
com.cimbmalaysia

Citibank MY:
com.citibank.CitibankMY

PB engage MY:
com.engage.pbb.pbengage2my.release

HSBC Malaysia:
my.com.hsbc.hsbcmalaysia

Maybank2u MY:
my.com.maybank2u.m2umobile

allianceonline Mobile:
com.alliance.AOPMobileApp

alrajhi@24seven Malaysia:
com.alrajhibank.mobile

BSNeBiz Mobile- Corporate User:
com.bsnebiz.cdb

AGRONet Mobile:
com.cedarplus.agro

GO by Bank Islam:
com.iexceed.CBS

MBSB Bank Mobile Banking:
com.MBSB.Bank.Mobile.Banking

OCBC Malaysia Mobile Banking:
com.ocbc.mobilemy

RHB Mobile Banking:
com.rhbgroup.rhbmobilebanking

HLB Connect Mobile Banking App:
my.com.hongleongconnect.mobileconnect


Nigeria List


FirstMobile:
com.firstbank.firstmobile

Access Bank plc:
com.accessbank.accessbankapp

Ecobank Mobile App:
com.app.ecobank

UBA Mobile Banking:
com.uba.vericash

Union Bank Mobile Banking:
com.unionbank.ecommerce.mobile.android

GTBank:
com.vanso.gtbankapp

Zenith Bank Mobile App:
com.zenithBank.eazymoney


Nederlands List


ING Bankieren:
com.ing.mobile

ABN AMRO:
com.abnamro.nl.mobile.payments

ICS Creditcard:
com.ics.nl.icscards


New Zealand List


ASB Mobile Banking:
nz.co.asb.asbmobile

Kiwibank Mobile Banking:
nz.co.kiwibank.mobile

Rabobank NZ:
com.rabobank.android.prod.nz

SBS Bank Mobile:
nz.co.sbsbank.mobile

Westpac One (NZ) Mobile Banking:
nz.co.westpac


Peru List


BBVA Perú:
com.bbva.nxt_peru

Banca Móvil BCP:
com.bcp.bank.bcp

Banco Santander Perú S.A.:
com.zoluxiones.officebanking

Interbank APP:
pe.com.interbank.mobilebanking

Scotiabank Perú:
pe.com.scotiabank.blpm.android.client

APP Banco Pichincha Perú:
pe.pichincha.bm


Poland List


BNP Paribas GOmobile:
com.finanteq.finance.bgz

CA24 Mobile:
com.finanteq.finance.ca

Getin Mobile:
com.getingroup.mobilebanking

plusbank24:
eu.eleader.mobilebanking.invest

Fakturownia.pl:
pl.fakturownia

IFIRMA - Darmowy Program do Faktur:
pl.ifirma.ifirmafaktury

Moje ING mobile:
pl.ing.mojeing

mBank PL:
pl.mbank

BPS Mobilnie:
pl.bps.bankowoscmobilna

CitiManager – Commercial Cards:
com.citi.mobile.ccc

IKO:
pl.pkobp.iko

PeoPay:
softax.pekao.powerpay

Bank Millennium:
wit.android.bcpBankingApp.millenniumPL

Santander mobile:
pl.bzwbk.bzwbk24

Alior Mobile:
pl.aliorbank.aib

Nest Bank:
pl.nestbank.nestbank


Portugal List


Caixadirecta:
cgd.pt.caixadirectaparticulares

Banco BIC, SA:
com.exictos.mbanka.bic

MY ATLANTICO:
eu.atlantico.bancoatlanticoapp

Banca Móvil:
com.baninter

BBVA Portugal:
com.bbva.mobile.pt

Santander Particulares:
pt.santandertotta.mobileparticulares

ActivoBank:
wit.android.bcpBankingApp.activoBank

Banco CTT:
pt.bctt.appbctt

CA Mobile:
ca.mobile.explorer

NB smart app:
pt.novobanco.nbapp

Caixadirecta Empresas:
pt.cgd.caixadirectaempresas

Millenniumbcp:
wit.android.bcpBankingApp.millennium

BPI APP:
pt.bancobpi.mobile.fiabilizacao

Best Bank:
pt.bancobest.android.mobilebanking

Santander Empresas Portugal:
pt.santandertotta.mobileempresas

ABANCA - Portugal:
com.abanca.bm.pt

Wizink. Um banco. Infinitas possibilidades:
app.wizink.pt

Bankinter Portugal:
com.bankinter.portugal.bmb

Banco BiG Portugal:
pt.bigonline.BiGMobile

MB WAY:
pt.sibs.android.mbway


Qatar List


QIB Mobile:
com.pozitron.qib

Doha Bank Mobile Banking:
com.db.mobilebanking

QNB Mobile:
com.vipera.ts.starter.QNB

QIIB Mobile:
com.QIIB

Ahlibank Personal Mobile App:
com.ahlibank.personal

HSBC Qatar:
qa.hsbc.hsbcqatar

KFC Qatar - Order food online:
com.kfc.qatar

Karwa Taxi - Official taxi:
com.karwatechnologies.karwataxi

Mashreq Qatar:
com.vipera.ts.starter.MashreqQA


Romania List


Libra Mobile Banking:
libra.mobile.banking

First Bank Romania:
ro.firstbank.direct

George Romania:
ro.bcr.georgego

Raiffeisen SmartToken:
ro.raiffeisen.eToken

Raiffeisen Smart Mobile PI:
ro.raiffeisen.smartmobile

NeoBT:
com.ebankit.com.bt

ING HomeBank:
ro.ing.mobile.banking.android.activity

ING Business:
ro.ing.business

MyBRD Mobile:
brd.bankingapp.android

Banca Transilvania:
ro.btrl.mobile

Mobile Banking (UniCredit Bank Romania):
hr.asseco.android.jimba.mUCI.ro

CEC Bank Mobile Banking:
hr.asseco.android.jimba.cecro

m-conect (Credit Agricole Bank Romania S.A.):
ro.ca.dem

Garanti BBVA Romania:
com.garantibank.cepsubesiro

Alpha Online Banking:
com.ofss.fcdb.mobile.android.alpharom.alphaandroid


Turkey List


Fibabanka:
com.fibabanka.Fibabanka.mobile

Fibabanka Kurumsal Mobil:
com.fibabanka.mobile

Paycell – Dijital Cüzdan, Ödeme ve Kart:
com.turkcell.paycell

QNB Finansbank:
com.finansbank.mobile.cepsube

ING Mobil:
com.ingbanktr.ingmobil

ininal:
com.ininal.wallet

Akbank:
com.akbank.android.apps.akbank_direkt

Kuveyt Türk Mobile:
com.kuveytturk.mobil

Odeabank:
com.magiclick.odeabank

Papara:
com.mobillium.papara

PTTBank:
com.pttfinans

Türkiye Finans Mobil Şube:
com.tfkb

Halkbank Mobil:
com.tmobtech.halkbank

Katılım Mobil:
com.ziraatkatilim.mobilebanking

Enpara.com Şirketim Cep Şubesi:
finansbank.enpara.sirketim

e-Devlet Kapısı:
tr.gov.turkiye.edevlet.kapisi

Trendyol - Online Alışveriş:
trendyol.com

N Kolay:
com.aktifbank.nkolay

Albaraka Mobil:
com.albarakaapp

Anadolubank Mobil:
com.anadolubank.android

fastPay:
com.intertech.mobilemoneytransfer.activity

Maximum İşyerim:
com.isbank.isyerim

İşCep - Mobil Bankacılık:
com.pozitron.iscep

CEPTETEB:
com.teb

CEPTETEB İŞTE:
com.teb.kurumsal

Enpara.com Cep Şubesi:
finansbank.enpara

PeP:
paladyum.peppara

Alternatif Bank Mobil:
tr.com.abank.dijital

HSBC Turkiye:
tr.com.hsbc.hsbcturkey.uk

Param:
tr.com.param.android

MobilDeniz:
com.denizbank.mobildeniz

Garanti BBVA Mobile:
com.garanti.cepsubesi

VakıfBank Mobil Bankacılık:
com.vakifbank.mobile

Yapı Kredi Mobile:
com.ykb.android

Ziraat Mobil:
com.ziraat.ziraatmobil


Israel List


com.fibi.nativeapp (NEW)

com.ideomobile.discount (NEW)

com.ideomobile.hapoalim (NEW)

com.leumi.leumiwallet (NEW)

com.MizrahiTefahot.nh (NEW)

il.co.yahav.mobbanking (NEW)


Japan List


jp.co.smbc.direct

jp.japanpost.post.postbox.android

jp.co.aeonbank.android.passbook

com.kakaobank.channel

com.feib.appbank

com.ubs.swidKXJ.android

com.willmobile.mobilebank.fcb

com.mtel.androidbea

jp.co.jcb.my

jp.co.netbk

jp.co.rakuten_bank.rakutenbank

jp.co.nttdata

jp.ne.paypay.android.app

jp.auone.wallet

cc.bitbank.bitbank

com.quoine.quoinex.light

jp.coincheck.android


Modern mobile malware for example “MetaDroid”, has an advanced implementation of WEB-injects aimed towards banking platforms, and may use several injects simultaneously. Below is an example of 5 victims using mobile devices under Android OS from China, Finland, Netherlands, France and United States with collected credentials from popular services.


metadroid webinjects banking financial mobile device


metadroid webinjects banking financial mobile device



Once the victim has been successfully infected and credentials have been delivered to a C2C Server, mobile malware enabled operators execute various commands to manage the victim and to perform actions on their devices for further successful theft (“Get SMS list”, “Send SMS” or “Forward Call”, for example:- when interacting with the bank’s validation systems to confirm transaction or OTP code). This set of commands may vary depending on the mobile banking malware family.


inject commands victim mobile malware otp send sms validation financial sector bank



Bots like ERMAC have functions to manage WEB-injects from C2C server (“Injections” – on the screenshot below):


ermac webinjects c2c injections screenshot malicious tool threat actor malware



Significance

There is no doubt, “In The Box” may be called the largest and probably the only one in its marketplace category providing high-quality webinjects for popular types of mobile malware. It is expected cybercriminals will continue to upgrade their tools to attack consumers, and will start developing more advanced webinjects as well. For today, "In the Box" is leveraged by cybercriminals to attack over 300 financial institutions (FIs), payment systems, social media and online-retailers in 43 countries.

Newsletter

Keep up to date with the latest cybersecurity news and developments.

By subscribing, I understand and agree that my personal data will be collected and processed according to the Privacy and Cookies Policy

Cloud Architecture
Cloud Architecture
445 S. Figueroa Street
Los Angeles, CA 90071
Google Maps
Contact us by filling out the form.
Try Resecurity products today with a free trial