By 
A new Android banking malware named Revive was discovered that targets users of Spanish financial services company BBVA.
The malware which is said to be in its early stages of development was tracked as Revive by Italian cybersecurity firm Cleafy. It was first observed on June 15, 2022 and distributed by means of phishing campaigns.
According to Cleafy researchers Federico Valentini and Francesco Iubatti, the malware was named Revive as one of the functionality of the malware is restarting, in case the malware stops working.
The malware that could be downloaded from rogue phishing pages as a lure to trick users into downloading the app, impersonates the bank's two-factor authentication (2FA) app and is said to be inspired from open-source spyware called Teardroid, with the authors tweaking the original source code to incorporate new features.
Revive is tailored for a specific target and here it is the BBVA bank and it leverages Android's accessibility services API to meet its operational objectives.
The malware is engineered to harvest the bank's login credentials through the use of lookalike pages and facilitate account takeover attacks. It also incorporates a keylogger module to capture keystrokes and the ability to intercept SMS messages received on the infected devices, primarily one-time passwords and 2FA codes sent by the bank.
When the victim opens the malicious app for the first time, the malware asks to accept two permissions related to the SMS and phone calls. After that, Revive continues running in the background as a simple keylogger, recording everything the user types on the device and sends it periodically to the C2.
So the credentials will be sent to the threat actors' C2, and then a generic homepage with links to the real website of the targeted bank is loaded.
These findings once again show the importance to be cautious when it comes to downloading apps from third-party untrusted sources.
