Security experts say the malicious app is called “Todo: Day manager.” Before it was removed from the Play Store, it had been downloaded over 1,000 times.
Experts found the app contains malware known as Xenomorph. This malware can steal login details that users enter for banking apps. It then quietly accesses victims’ bank accounts and steals all their money.
What’s worse, this malware can block SMS messages and notifications that send one-time passwords (OTPs) to hackers, bypassing two-factor authentication. That makes it nearly impossible for users to protect their accounts from this threat.
Experts warn that anyone who has installed “Todo: Day manager” should uninstall it immediately to avoid having their bank accounts compromised.
According to PhoneArena, to avoid falling for scam apps, users should carefully read reviews before downloading, especially if the developer is unknown.
