What you need to know
- Dutch research firm ThreatFabric has discovered malware that can steal two-factor authentication codes from Google Authenticator.
- Cerberus is the name of the banking trojan, but the strain that can steal 2FA codes is currently in testing and not yet available.
- In general, it is more secure to use an app to generate 2FA codes such as Google Authenticator instead of using SMS.
Two-factor authentication or 2FA is a commonly used system to help protect your online accounts. It requires a user to enter an additional code when logging in, which is usually sent through SMS or generated with an app. In general, it is best to use an app to generate the code, such as Google Authenticator, instead of allowing it to be sent over the network to your phone where you run the risk of it being intercepted.
Unfortunately, security researchers from ThreatFabric recently discovered a strain of the Cerberus banking trojan, which can steal 2FA codes from Google Authenticator.
Abusing the Accessibility privileges, the Trojan can now also steal 2FA codes from Google Authenticator application.When the [Authenticator] app is running, the Trojan can get the content of the interface and can send it to the [command-and-control] server.
In the report, the Dutch mobile security firm said, "We believe that this variant of Cerberus is still in the test phase but might be released soon."
While Cerberus is primarily a banking trojan, the researches note that it now includes many features found in traditional remote access trojans. This would allow users with Cerberus to remotely access your phone and access your bank account, including stealing the 2FA code if needed. It would also allow the attacker to access any other accounts you have enabled two-factor authentication on, such as your email, social media, shopping sites, and more.
Fortunately, for the time being, the Cerberus variant with 2FA stealing capabilities appears to still be in testing, and not out in the wild. Hopefully, by the time it has launched, Google will have found a way to prevent it from accessing two-factor authentication codes.
