Hackers deploy virtual Android phones to bypass bank security and empty user accounts: Cybersecurity researchers

Cybercriminals are now using virtual phones to trick banks’ fraud protections and drain customers’ accounts.

Citing cybersecurity firm Group-IB, Malwarebytes researcher Peter Arntz He says Criminals rent cheap, internet-connected Android smartphones and use them to bypass banks’ security checks.

“The beginning of the attack is still social engineering. Criminals attempt to trick users into sharing one-time passwords (OTPs), approving a login, or making a ‘to a secure account’ transfer.”

Behind the scenes, the criminal logs into a cloud phone instance that actually looks like the victim’s device to their bank, thanks to matching or plausible fingerprints and pre-configured behavior. Once inside, criminals carry out authorized payment (APP) transfers (often to money smuggling accounts), which the bank’s systems may treat as low risk because nothing is obviously wrong with the device.

At this point criminals can start emptying your account or selling virtual phones to other criminals.

Arents says cybercriminals rent cloud phones from platforms that offer device rentals for just $0.10 to $0.50 per hour, making the technology needed to commit fraud widely available.

To stay safe from cloud phone scams, Group-IB and Malwarebytes recommend that people never share one-time passwords (OTPs), agree to unexpected logins, or make transfers to a “secure account.”

These are classic social engineering tricks that let criminals in.

They say users should always double-check any banking request by contacting the bank directly through an official app or phone number, turn on transaction alerts and monitor accounts regularly to spot anything suspicious and stop it immediately.

Follow us on X, Facebook and cable

Never miss a beat – Subscribe Get email alerts delivered directly to your inbox

browse Hodel’s daily mix

Generated image: mid-flight