Android banking applications have revolutionized financial management by allowing users to perform various financial activities through mobile devices. However, this convenience has attracted cybercriminals who exploit security vulnerabilities to access sensitive financial data. FjordPhantom, a malware identified by our industry collaborator, uses virtualization and hooking to bypass the detection of malicious accessibility services, allowing it to conduct keylogging, screen scraping, and unauthorized data access. This malware primarily affects banking and finance apps across East and Southeast Asia region where our industry partner's clients are primarily based in. It requires users to be deceived into installing a secondary malicious component and activating a malicious accessibility service. In our study, we conducted an empirical study on the susceptibility of banking apps in the region to FjordPhantom, analyzed the effectiveness of protective measures currently implemented in those apps, and discussed ways to detect and prevent such attacks by identifying and mitigating the vulnerabilities exploited by this malware.

翻译：安卓银行应用通过移动设备实现多样化金融活动，彻底改变了财务管理方式。然而，这种便利性也吸引了网络犯罪分子利用安全漏洞获取敏感金融数据。FjordPhantom是我们行业合作伙伴发现的一款恶意软件，它利用虚拟化和钩子技术绕过恶意无障碍服务的检测，从而实现键盘记录、屏幕抓取和未经授权的数据访问。该恶意软件主要影响东亚和东南亚地区的银行与金融应用，我们行业合作伙伴的客户主要集中在该区域。它需要诱骗用户安装次级恶意组件并激活恶意无障碍服务。在本研究中，我们对区域内银行应用受FjordPhantom攻击的脆弱性进行了实证研究，分析了这些应用当前实施保护措施的有效性，并通过识别和缓解该恶意软件所利用的漏洞，探讨了检测与防范此类攻击的方法。