Researchers have unearthed another malicious app exploiting a critical vulnerability in Google’s Android OS that allows attackers to inject malicious code into legitimate programs without invalidating their digital signature.
The threat poses as an update for the official Android app available to customers of NH Nonghyup Bank, one of South Korea’s biggest financial institutions, according to a blog post published Friday by researchers from antivirus provider Trend Micro. By exploiting the so-called master-key vulnerability in the mobile OS, this malware bears the same cryptographic signature found in the legitimate release, even though the update contains malicious code that uploads user credentials to a remote server.