Beware of Fraudulent Scholarship Apps Attacking Students in Defarud Campaign
## Cybersecurity: Malware Targeting Students in Bangladesh
Cybersecurity: Malware Targeting Students in Bangladesh
A sophisticated Android malware campaign has been identified, targeting students in Bangladesh by masquerading as legitimate scholarship applications.
The fraudulent applications are disguised as official apps from the Bangladesh Education Board, misleading users with promises of financial aid. Users are directed to download APKs from shortened URLs.
Once installed, the malware collects personal and financial data, intercepts SMS messages, and exploits device permissions to conduct unauthorized banking transactions.
Due to its low detection rate on VirusTotal, the malware evades traditional security controls. It primarily spreads through smishing campaigns, where students receive SMS links redirecting them to malicious APK hosting sites such as appsloads.top and downloadapp.website.
A sophisticated Android malware campaign has been identified, targeting students in Bangladesh by masquerading as legitimate scholarship applications.
After installation, users are prompted to sign in via Google or Facebook, entering sensitive details such as their full name and institutional affiliations. The malware requests high-risk permissions, including Accessibility Service, SMS access, overlay, and call management rights. These permissions enable the app to capture incoming SMS messages and forward them to a Firebase-hosted command and control server.
Once permissions are escalated, the malware automates banking transactions by exploiting Accessibility Service, monitoring foreground applications, and interacting with targeted banking apps like bKash and Nagad. It retrieves one-time PINs from the C2 server to facilitate unauthorized transactions.
AccessibilityNodeInfo node = rootNode.findFocus(AccessibilityNodeInfo.FOCUS_INPUT); Bundle args = new Bundle(); args.putCharSequence(AccessibilityNodeInfo.ACTION_ARGUMENT_SET_TEXT_CHARSEQUENCE, pin); node.performAction(AccessibilityNodeInfo.ACTION_SET_TEXT, args); node.performAction(AccessibilityNodeInfo.ACTION_CLICK);
The malware combines social engineering with stealthy permission abuse. Following APK installation, it copies its file to a hidden directory and registers as a device administrator, complicating uninstallation attempts. It injects receiver components into the AndroidManifest.xml to ensure persistence across reboots and periodically contacts the Firebase C2 endpoint to fetch new modules.
Through abuse of the Accessibility Service, the malware can reactivate its services if disabled by users. The combination of persistent device administrator rights, manifest-declared receivers, and periodic C2 polling makes it highly resilient against removal and detection.
Based on reporting by Cyber Security News.