Kaspersky discovered a news strain of the mobile banking Trojan Faketoken that displays overlays on top of taxi booking apps to steal banking information.

Security experts from Kaspersky have discovered a news strain of the infamous mobile banking trojan Faketoken that implements capabilities to detect and record an infected device’s calls and display overlays on top of taxi booking apps to steal banking information.

“The authors of its newer modifications continue to upgrade the malware, while its geographical spread is growing. Some of these modifications contain overlay mechanisms for about 2,000 financial apps. In one of the newest versions, we also detected a mechanism for attacking apps for booking taxis and paying traffic tickets issued by the Main Directorate for Road Traffic Safety.” states the analysis published by Kaspersky.

In December, Kaspersky observed the Android ransomware Faketoken was enhanced with file-encrypting abilities.

Now the new variant of the malware dubbed Faketoken.q was improved again to steal credentials from Uber and other booking apps as well.

Faketoken.q is being distributed using bulk SMS messages to trick users into downloading an image file that actually downloads the malware.

The mobile Trojan is composed of two parts, the first part is an obfuscated dropper (verdict: Trojan-Banker.AndroidOS.Fyec.az), the second one is a file with DAT extensions that contains the malware’s main features.

Once victims have downloaded the Android malware it installs the necessary modules and the main payload, which hides its shortcut icon and starts monitoring user’s activities, including calls to launched apps.