Scary Android malware can steal your 2FA codes and swipe patterns

By Kate Kozuch
last updated

Even 2FA isn't safe with this Android malware

Android malware
(Image credit: Tom's Guide)

Android users, beware. A security consulting firm has identified a malware upgrade that can remotely access smartphones to steal unlock credentials and 2FA Google Authenticator codes.

The update report comes from Dutch mobile security firm ThreatFabric (opens in new tab) (via ZDNet (opens in new tab)) and details the alarming Remote Access Trojan (RAT) capabilities bestowed on the Cerberus banking Trojan that launched last summer. When enabled in a victim's phone, RAT features let Cerebrus operators record the user's unlock PIN, swipe pattern and even Google Authenticator's 2FA codes.

Google Authenticator is a useful tool that helps people add an extra layer of security to their important accounts, including those used for online banking. But according to ThreatFabric, Cerberus's new RAT powers would let attackers steal the 2FA code, access a victim's financial account and transfer funds to themselves.

Of course there's a plethora of information hackers could nab with Authenticator codes, but banking is Cerberus's usual target.

Because Google Authenticator codes are created and stored locally on phones, online accounts with 2FA layers from Authenticator are considered better protected than those that use one-time, SMS-based credentials.

But should Cerberus's RAT upgrade reach bad actors, Authenticator would be compromised. 

To some relief, ThreatFabric says the RAT feature is not active in version of Cerberus currently advertised and sold on hacking forums. However, researchers say it "might be released soon," meaning hackers could get their hands on the advanced malware.

Knowing that malware has these new capabilities likely means measures are already being taken by Android and app developers to bulk up software security. 

Although there's no action users can take now, make sure to always install security updates as soon as they become available. 

Kate Kozuch
Kate Kozuch

Kate Kozuch is an editor at Tom’s Guide covering smartwatches, TVs and everything smart-home related. Kate also appears on Fox News to talk tech trends and runs the Tom's Guide TikTok account (opens in new tab), which you should be following. When she’s not filming tech videos, you can find her on an exercise bike, mastering the NYT Crossword or channeling her inner celebrity chef.