---

Security researchers have recently uncovered a sophisticated Android banking trojan dubbed Brokewell. This malware poses a severe threat as it can infiltrate Android devices, capturing every user interaction and stealing sensitive data.

Brokewell is primarily distributed through fake Google Chrome update pages, which are displayed while users are browsing the web. Once installed, the malware operates stealthily, with capabilities ranging from data theft to remote device control.

Brokewell’s Capabilities:Data Theft:

Data Theft:

• Mimics login screens of targeted applications to steal credentials through overlay attacks. Overlay attacks are a form of cyber attack where malicious software overlays a fake login screen on top of legitimate applications or websites to trick users into entering their credentials. In the case of Brokewell malware, it mimics the login screens of targeted applications using this technique, making users believe they are logging into their accounts as usual. However, the credentials entered are captured by the malware and sent to the attackers, compromising the user’s account security. This method is particularly deceptive as it appears legitimate to the user, increasing the likelihood of successful credential theft.
• Utilizes its own WebView to intercept and extract cookies post-login on legitimate sites. Brokewell malware employs its own WebView, a component used to display web content within an Android application, to intercept and extract cookies after a user logs into legitimate websites. Cookies are small pieces of data stored on the user’s device by websites, often containing session identifiers or other authentication tokens. By intercepting and extracting these cookies post-login, Brokewell can access sensitive information such as session tokens, allowing the attackers to maintain unauthorized access to the user’s accounts on legitimate sites. This technique enables the malware to bypass traditional login authentication mechanisms and gain persistent access to the user’s online accounts.
• Captures user interactions such as taps, swipes, and text inputs, extracting sensitive data. Brokewell malware is designed to capture various user interactions, including taps, swipes, and text inputs, with the aim of extracting sensitive data. By monitoring these interactions, the malware can gather valuable information entered by the user, such as login credentials, personal messages, financial details, and more. This comprehensive approach allows Brokewell to harvest a wide range of sensitive data from infected Android devices, posing a significant risk to user privacy and security. Once collected, this information can be used for various malicious purposes, including identity theft, financial fraud, and unauthorized access to accounts and services.
• In addition to capturing user interactions, Brokewell malware also gathers various hardware and software details, call logs, and device location information from infected Android devices. This data collection allows the attackers to build a comprehensive profile of the device and its user, enhancing their ability to carry out targeted attacks or exploit vulnerabilities for malicious purposes. Hardware and software details may include information about the device model, operating system version, installed applications, and system configurations. Call logs provide insights into the user’s communication patterns, including contacts, call durations, and timestamps. Device location information enables the attackers to track the physical whereabouts of the device and potentially the user, compromising their privacy and security. By gathering this wealth of information, Brokewell malware enables attackers to better understand their targets and tailor their malicious activities accordingly. This underscores the importance of implementing robust security measures to protect against such threats and safeguard personal and sensitive information from unauthorized access and misuse.
• Indeed, Brokewell malware goes to the extent of capturing audio using the microphone of the infected Android device. This capability allows the attackers to eavesdrop on conversations, record ambient sounds, and potentially gather sensitive information shared verbally by the device’s user. By surreptitiously activating the microphone without the user’s knowledge or consent, the malware breaches their privacy and can intercept confidential conversations, passwords, financial transactions, and other sensitive information. The ability to capture audio further enhances the malware’s espionage capabilities, enabling attackers to gather valuable intelligence for various malicious purposes, including extortion, blackmail, and espionage. This underscores the critical importance of securing mobile devices against malware threats and ensuring that users remain vigilant about the apps they download and the permissions they grant to prevent unauthorized access to sensitive functions such as the microphone.

Device Takeover:

• One of the sophisticated features of Brokewell malware is its ability to enable real-time screen streaming, allowing attackers to remotely monitor the device’s screen activity. This means that the malware can capture what is displayed on the device’s screen and stream it live to the attackers’ command and control server. By providing remote access to the device’s screen, attackers can observe the user’s interactions, view sensitive information displayed on the screen, and even identify potential targets for further exploitation. This feature grants attackers a comprehensive view of the device’s usage patterns, enabling them to gather additional intelligence and potentially launch targeted attacks. The real-time screen streaming capability of Brokewell malware underscores the invasive nature of this threat and highlights the importance of implementing robust security measures to protect against such attacks. Users should remain vigilant and take proactive steps to safeguard their devices from malware infections, including keeping software up-to-date, avoiding suspicious links and downloads, and using reputable antivirus software.
• Brokewell malware doesn’t just passively monitor the infected device; it also enables attackers to remotely execute touch, swipe, and button press gestures. This means that the attackers can manipulate the device’s interface as if they were physically interacting with it, even though they are accessing it remotely.By remotely controlling touch, swipe, and button press gestures, attackers can perform various actions on the device without the user’s knowledge or consent. This capability allows them to navigate through menus, interact with applications, and even initiate transactions or perform other sensitive operations on behalf of the user.The ability to remotely execute gestures gives attackers a high degree of control over the infected device, enabling them to carry out a wide range of malicious activities, such as stealing sensitive information, initiating unauthorized transactions, or installing additional malware.
• Permits remote clicking on screen elements, scrolling within elements, and typing text.
• Can simulate physical button presses like Back, Home, and Recents.
• Adjusts device settings like brightness and volume remotely.

Threat Actor and Loader:
The developer behind Brokewell identifies themselves as Baron Samedit. Samedit has been selling tools for checking stolen accounts for at least two years. Additionally, a tool called “Brokewell Android Loader,” developed by Samedit, was discovered. This loader bypasses Google’s restrictions introduced in Android 13 and later versions, allowing malicious apps to abuse Accessibility Service.

Preventive Measures:
To safeguard against Android malware infections, users should adhere to the following precautions:

• Download Apps from Trusted Sources: Avoid downloading apps or updates from sources outside Google Play Store.
• Activate Google Play Protect: Ensure Google Play Protect is active on the device at all times to detect and remove malicious apps.
• Install Antivirus Apps: Consider installing reputable antivirus apps from trusted sources to provide an additional layer of protection against malware threats.
• Regularly Update Software: Keep the device’s operating system and applications up-to-date to patch known vulnerabilities and enhance security.
• Exercise Caution: Be cautious while browsing the internet and interacting with unknown links or pop-ups to avoid inadvertently downloading malware.

It’s essential to remain vigilant and adopt preventive measures to mitigate the risk of falling victim to sophisticated malware like Brokewell. By staying informed and employing robust security practices, users can better safeguard their devices and data from cyber threats.

---

About Author