“The developer of SpyNote, who was previously selling it to individuals via his Telegram channel, made the source code public on GitHub. This has helped hackers further develop and distribute the spyware, often also targeting banking institutions,” said ThreatFabric. SpyNote is a feature-rich application that can install arbitrary apps, gather SMS messages, calls, videos, and audio recordings, track GPS locations, and even prevent attempts to uninstall the app. According to ThreatFabric, “One of the main differences between the first variants, SpyNote.A and SpyNote.B, and the latest one, SpyNote.C, is the campaign objective. SpyNote.C has been the first variant to openly target banking applications, impersonating a large number of reputable financial institutions like HSBC, Deutsche Bank, Kotak Bank, and BurlaNubank, as well as others to well-known applications like WhatsApp, Facebook, and Google Play.” Similarly to other banking malware, SpyNote requests access to accessibility services to extract two-factor authentication (2FA) codes from Google Authenticator and record keystrokes to deceive banking credentials. SpyNote utilizes Android’s MediaProjection API to capture screen content and steal Facebook and Gmail passwords. It is also able to pose as the official Google Play Store service and other generic applications in the productivity, gaming, and wallpapers categories. As per ThreatFabric, these are a few of the SpyNote artifacts that are mainly delivered through smishing attacks:
Bank of America Confirmation (Package Name – yps.eton.application) Kotak Bank (Package Name – splash.app.main) HSBC UK Mobile Banking (Package Name – com.employ.mb) BurlaNubank (Package Name – com.appser.verapp) Deutsche Bank Mobile (Package Name – com.reporting.efficiency) Current Activity (Package Name – com.willme.topactivity) Conversations_ (Package Name – com.appser.verapp) Virtual SimCard (Pacakge Name – cobi0jbpm.apvy8vjjvpser.verapchvvhbjbjq)
The Dutch Security Firm estimated that 87 different customers purchased SpyNote.C between August 2021 and October 2022 after its developer advertised it on Telegram under the name CypherRat. However, it appears that several criminal groups are co-opting CypherRat in their campaigns since SpyNote became open source in October 2022. “SpyNote will keep using Accessibility Service to collect essential data from users’ devices and it will be able to develop towards a successful distribution. We also believe that the trend will continue adopting better security measures like obfuscation and packers to help safeguard the program itself. Different forks of SpyNote will likely continue appearing, following the release of its source code”, the company predicted.
