Shell Game Malware

A coordinated attack on banking weakness

This scheme is unique because it exploits vulnerabilities in both traditional banks and neobanks in a coordinated way to bypass standard fraud detection. Traditional banks often overlook inter-account transfers, treating them as low-risk, while neobanks, with weaker fraud controls and a mobile-only approach, create an environment where malware can bypass security and give fraudsters full control over transactions.

Smart social engineering  

The fraudster kicks off the attack with a well-crafted phishing scheme to gain control of the victim’s device and install malware. If they haven’t already discovered it, the malware helps identify if the victim has multiple bank accounts. Once installed, the fraudster gains full control over the device, allowing them to:

• Access sensitive personal info like usernames, passwords, and 2FA codes.
• Remotely control the device to approve transactions or initiate transfers.

Exploiting Inter-accounts Transfers

Once the malware controls the victim’s device, the fraudster initiates a transfer from the victim’s traditional bank account (Bank A) to a neobank account (Bank B). Transfers between accounts of the same individual are less scrutinized, allowing them to pass unnoticed. Bank A’s systems do not flag the transaction, as it resembles the victim’s usual behavior, and the payee is considered trusted, bypassing fraud checks. This often results in exceptions to Security Code Authentication (SCA) requirements, enabling the fraudster to move funds instantly without raising red flags.

Final Fraudulent Transfer

Once the funds are in the neobank account (Bank B), the fraudster quickly transfers the stolen money to external accounts, cryptocurrency wallets, or other untraceable destinations. Due to weaker security at Bank B, these transactions go undetected. The malware allows the fraudster to bypass security checks, including device possession requirements. In a mobile-only context, the fraudster gains full control over the transaction and SCA (Strong Customer Authentication) steps, enabling them to move the funds without raising alarms and making it harder for authorities to trace the money.

Why Target Bank B?

Fraudsters target Bank B due to key vulnerabilities: weak real-time transaction monitoring, a mobile-only approach where the SCA flow is on the same device targeted by the malware, giving full control once the device is compromised. There’s also a lower chance of blocking suspicious transfers and less focus on geographical anomalies, as neobanks often operate across Europe, making it easier for stolen funds to move undetected.