A prominent fraud prevention service says international crime groups are spreading malware designed to steal victims’ banking information.

The London-based Credit Industry Fraud Avoidance System (CIFAS) says it is witnessing a surge in Android malware attacks targeting banking apps.

CIFAS says that while the malware targets Android users, other mobile platforms are not immune to attacks, noting that the malicious software may have hit 200,000 victims in just six months.

“These malicious apps often look like legitimate tools – such as file managers, PDF readers, phone cleaners, or even browsers like Google Chrome. Once installed, they can appear harmless but later activate harmful features through hidden updates.

Key techniques criminals use include:

Overlaying fake login screens on top of real banking apps to steal login credentials.

Displaying deceptive ‘busy’ or ‘waiting’ screens to mask fraudulent activity.

Preventing users from exiting the app or restarting their device.

Requesting excessive permissions, especially ‘accessibility’ access.”

According to CIFAS, users should be on the lookout for signs that their phones are infected with malware, including prompts to reauthenticate during a banking session, “busy” messages from banking apps, unexpected notifications to update or install Google Chrome and prompts to grant unusual permissions, particularly accessibility access.

Says CIFAS CEO Mike Haley,

“The surge in Android malware is not just a tech issue – it’s a growing threat to consumers and to banking services we all rely on. Criminals are evolving their tactics faster than ever, using deception and stealth to bypass traditional security measures.

The best defence is awareness. If something feels off – an unexpected update, a strange app request – stop before you tap and always seek a second opinion. Education and vigilance are our frontline tools in the fight against fraud.”

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

A new malware campaign targeting WordPress sites employs a malicious plugin disguised as a security tool to trick users into installing and trusting it.

According to Wordfence researchers, the malware provides attackers with persistent access, remote code execution, and JavaScript injection. At the same time, it remains hidden from the plugin dashboard to evade detection.

Wordfence first discovered the malware during a site cleanup in late January 2025, where it found a modified ‘wp-cron.php’ file, which creates and programmatically activates a malicious plugin named ‘WP-antymalwary-bot.php.’

Other plugin names used in the campaign include:

• addons.php
• wpconsole.php
• wp-performance-booster.php
• scr.php

If the plugin is deleted, wp-cron.php re-creates and reactivates it automatically on the next site visit.

Lacking server logs to help identify the exact infection chain, Wordfence hypothesizes the infection occurs via a compromised hosting account or FTP credentials.

Not much is known about the perpetrators, though the researchers noted that the command and control (C2) server is located in Cyprus, and there are traits similar to a June 2024 supply chain attack.

Once active on the server, the plugin performs a self-status check and then gives the attacker administrator access.

“The plugin provides immediate administrator access to threat actors via the emergency_login_all_admins function,” explains Wordfence in its writeup.

“This function utilizes the emergency_login GET parameter in order to allow attackers to obtain administrator access to the dashboard.”

“If the correct cleartext password is provided, the function fetches all administrator user records from the database, picks the first one, and logs the attacker in as that user.”

Next, the plugin registers an unauthenticated custom REST API route that allows the insertion of arbitrary PHP code into all active theme header.php files, clearing of plugin caches, and other commands processed via a POST parameter.

An updated version of the malware can also inject base64-decoded JavaScript into the site’s

section, likely for serving visitors ads, spam, or redirecting them to unsafe sites.

Apart from file-based indicators like the listed plugins, website owners should scrutinize their ‘wp-cron.php’ and ‘header.php’ files for unexpected additions or modifications.

Access logs containing ’emergency_login,’ ‘check_plugin,’ ‘urlchange,’ and ‘key’ should also serve as red flags, warranting further investigation.