Mobile banking users worldwide are facing a heightened risk with the emergence of a new and advanced variant of the Octo malware family, known as “Octo2.” ThreatFabric analysts have uncovered this new threat, which introduces several sophisticated features aimed at improving remote access and evasion capabilities.

Octo malware has been a pervasive mobile threat in recent years, but Octo2 takes it to a whole new level. Its primary enhancements focus on increasing the stability of remote access capabilities, making it a key player in device takeover attacks. The variant significantly reduces latency during remote control sessions, even under poor network conditions, by optimizing data transmission.

In addition, Octo2 integrates advanced obfuscation techniques, including a domain generation algorithm (DGA). This allows the malware to dynamically change its command-and-control (C2) server addresses, making it even more difficult for security systems to detect.

Key Features of Octo2:

• Enhanced remote access capabilities for device takeover attacks
• Optimized data transmission for reduced latency
• Advanced obfuscation techniques, including a domain generation algorithm

Octo2 has already been deployed in targeted campaigns across several European countries, including Italy, Poland, Moldova, and Hungary. Cybercriminals are disguising the malware as legitimate applications like Google Chrome and NordVPN to trick users. Furthermore, Octo2 is designed to intercept push notifications from select apps, indicating the interests of its operators.

ThreatFabric commented on the significant evolution of Octo2 in the mobile malware landscape, particularly in the context of banking security. With its enhanced remote access capabilities and advanced obfuscation techniques, Octo2 is poised to continue being a major player alongside its older variants.

As the threat landscape evolves, both users and financial institutions must remain vigilant. It is crucial to adopt stringent security measures and continuously update defenses to mitigate the increased risk posed by Octo2 and other mobile malware variants.

For more insights on mobile threats, check out: NCSC’s New Mobile Risk Model Aimed at “High-Threat” Firms.