What you need to know
- Dutch research firm ThreatFabric has discovered malware that can steal two-factor authentication codes from Google Authenticator.
- Cerberus is the name of the banking trojan, but the strain that can steal 2FA codes is currently in testing and not yet available.
- In general, it is more secure to use an app to generate 2FA codes such as Google Authenticator instead of using SMS.
Two-factor authentication or 2FA is a commonly used system to help protect your online accounts. It requires a user to enter an additional code when logging in, which is usually sent through SMS or generated with an app. In general, it is best to use an app to generate the code, such as Google Authenticator, instead of allowing it to be sent over the network to your phone where you run the risk of it being intercepted.
Unfortunately, security researchers from ThreatFabric recently discovered a strain of the Cerberus banking trojan, which can steal 2FA codes from Google Authenticator.
Abusing the Accessibility privileges, the Trojan can now also steal 2FA codes from Google Authenticator application.
When the [Authenticator] app is running, the Trojan can get the content of the interface and can send it to the [command-and-control] server.
In the report, the Dutch mobile security firm said, "We believe that this variant of Cerberus is still in the test phase but might be released soon."
While Cerberus is primarily a banking trojan, the researches note that it now includes many features found in traditional remote access trojans. This would allow users with Cerberus to remotely access your phone and access your bank account, including stealing the 2FA code if needed. It would also allow the attacker to access any other accounts you have enabled two-factor authentication on, such as your email, social media, shopping sites, and more.
Fortunately, for the time being, the Cerberus variant with 2FA stealing capabilities appears to still be in testing, and not out in the wild. Hopefully, by the time it has launched, Google will have found a way to prevent it from accessing two-factor authentication codes.
We may earn a commission for purchases using our links. Learn more.
I turned off my phone for a day and it was the best decision I made in 2020
The internet is great and useful for so many things. But a day without it was like a reboot inside me. You should try it.
Review: Dyson Pure Humidify + Cool is an incredible three-in-one system
Dyson's latest product combines a fan, air purifier, and humidifier into a single unit. The Pure Humidify + Cool has a premium design, delivers outstanding performance at both purification and humidification, and is an ideal product for the new work-from-home normal.
Don't delete your Oculus Facebook account if you want to keep your games
Nowadays, your Facebook account is your Oculus account. Make sure you don't delete it if you want to keep your games.
Keep your Samsung Galaxy Watch 3 looking stylish with a new band
If you recently purchasedthe new Samsung Galaxy Watch 3 or you're planning to do so soon, make sure you've got the right bands for it!