A prominent fraud prevention service says international crime groups are spreading malware designed to steal victims’ banking information.

The London-based Credit Industry Fraud Avoidance System (CIFAS) says it is witnessing a surge in Android malware attacks targeting banking apps.

CIFAS says that while the malware targets Android users, other mobile platforms are not immune to attacks, noting that the malicious software may have hit 200,000 victims in just six months.

“These malicious apps often look like legitimate tools – such as file managers, PDF readers, phone cleaners, or even browsers like Google Chrome. Once installed, they can appear harmless but later activate harmful features through hidden updates.

Key techniques criminals use include:

Overlaying fake login screens on top of real banking apps to steal login credentials.

Displaying deceptive ‘busy’ or ‘waiting’ screens to mask fraudulent activity.

Preventing users from exiting the app or restarting their device.

Requesting excessive permissions, especially ‘accessibility’ access.”

According to CIFAS, users should be on the lookout for signs that their phones are infected with malware, including prompts to reauthenticate during a banking session, “busy” messages from banking apps, unexpected notifications to update or install Google Chrome and prompts to grant unusual permissions, particularly accessibility access.

Says CIFAS CEO Mike Haley,

“The surge in Android malware is not just a tech issue – it’s a growing threat to consumers and to banking services we all rely on. Criminals are evolving their tactics faster than ever, using deception and stealth to bypass traditional security measures.

The best defence is awareness. If something feels off – an unexpected update, a strange app request – stop before you tap and always seek a second opinion. Education and vigilance are our frontline tools in the fight against fraud.”

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

A major cybersecurity incident affecting the sensitive personal and financial information of hundreds of thousands of Americans has been revealed.

In a new filing with the Office of the Maine Attorney General, Georgia-based healthcare firm Harbin Clinic says it discovered a serious breach affecting 210,140 people.

The firm says an unknown attacker gained unauthorized access to the database of its third-party vendor, Nationwide Recovery Services (NRS), stealing customer records, including names, addresses, Social Security numbers, dates of birth and financial account records.

The Harbin Clinic says it uses NRS for a debt collection service to recover funds from customers with delinquent accounts.

“It is our understanding that, in July 2024, NRS discovered suspicious activity related to its information technology systems, which resulted in a network outage. NRS indicated that it determined through an investigation that there was unauthorized access to the NRS network between July 5th, 2024 and July 11th, 2024, during which time certain files and folders were illegally copied from NRS’s systems by someone without authorization. NRS reported it [and] began a lengthy review to determine what information was contained on the impacted NRS systems and which NRS clients were impacted.

As a result of this review, NRS notified Harbin Clinic in February 2025 that information from Harbin Clinic’s patients may have been present on the impacted systems, but it was not yet able to identify which individuals had been impacted.” 

Harbin Clinic is a multi-specialty medical group offering a wide array of services, such as family medicine, internal medicine, oncology and cardiology.

The firm says it immediately sent letters of notification to affected customers to inform them about the data breach, while offering free identity monitoring services to affected individuals.

Harbin Clinic says it has not yet detected any instance involving the misuse of customer data. The firm is also urging customers to stay vigilant and report any suspicious activity related to their financial accounts.

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney

The incident, reported on Friday by Bitcoinist, marks one of the largest cryptocurrency hacks in history, with losses estimated at over $1.5 billion.

Bybit Hack Linked To North Korea’s Lazarus Group

According to Bybit, the breach occurred during a transfer from their ETH multisig cold wallet to a warm wallet. The exchange revealed on social media platform X (formerly Twitter) that the attack was executed through a “sophisticated manipulation” of the transaction process. 

This manipulation allowed the hacker to mask the signing interface, which displayed the correct wallet address while altering the underlying smart contract logic. 

Subsequently, on-chain market intelligence firm Arkham Intelligence revealed that crypto sleuth ZachXBT has provided compelling evidence linking the hack to the notorious Lazarus Group, a North Korea-backed hacker organization. 

In his detailed analysis, ZachXBT reportedly submitted findings that included test transactions, associated wallets, forensic charts, and timing analyses. This information has been shared with Bybit to assist in its ongoing investigation.

$1.44 Billion In Misappropriated Assets

The scale of the breach is staggering. Estimates suggest that approximately 401,347 ETH, valued at around $1.12 billion, were withdrawn. 

Additionally, other assets lost in the hack include 90,376 stETH worth $253.16 million, 15,000 cmETH valued at $44.13 million, and 8,000 mETH totaling $23 million. The total estimated loss stands at approximately $1.44 billion.

In light of this incident, Bybit has activated its security team and is collaborating with leading blockchain forensic experts to conduct a thorough investigation. 

The exchange has also reached out to other teams with expertise in blockchain analytics and fund recovery, inviting them to assist in tracing the misappropriated assets.

It remains to be seen what further action Bybit will take with the information provided by ZachXBT and how the case will unfold regarding the misappropriated customer funds. 

As for ETH’s price, the second largest cryptocurrency on the market has seen a 4% retracement towards $2,640 just hours after the security breach. 

Featured image from DALL-E, chart from TradingView.com