{"id":82053,"date":"2017-11-07T15:43:24","date_gmt":"2017-11-07T23:43:24","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=82053"},"modified":"2025-08-13T23:07:35","modified_gmt":"2025-08-14T06:07:35","slug":"marcher-malware","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/marcher-malware\/","title":{"rendered":"Marcher Malware Uses Both Credential and Credit Card Phishing to Steal Financial Data"},"content":{"rendered":"

Actors turned models turned singers — pretty much the definition of a \u201ctriple threat\u201d in the entertainment industry. However, the definition changes a bit for the cybersecurity space, as Android users are faced with a different type of \u201ctriple threat.\u201d In fact, it\u2019s a new attack campaign<\/a> involving three malicious tactics: credential phishing, credit card data theft, and the Marcher banking trojan.<\/p>\n

What is it and how does it work?<\/b><\/h2>\n

The newest form of Marcher pairs credential and credit card phishing with banking trojans into one multi-step scheme. The attack starts with a phishing email containing a bit.ly link to a fake version of the Bank Austria login page, which was registered to a variety of domains containing \u201cbankaustria\u201d in the title in order to give the appearance of legitimacy. Upon opening the page, users will be asked to supply their customer details, email, and phone number– which gives the attackers what they need for the next stage of the attack.<\/p>\n

Leveraging the customer data that was provided by the unknowing user, the attack intimidates the victim into downloading the \u201cnew Bank Austria\u201d app, aka a fake app. The user is then directed to a link for app download. Once installed, the app asks permission to a plethora of personal data and device settings, and places a legitimate looking icon on the phone’s home screen. Mind you, the app and everything involved in the campaign uses stolen branding from Bank Austria. So, it\u2019s easy to believe that this scam is the real thing.<\/p>\n

Finally, Marcher moves onto data collection. But it\u2019s important to remember — this version of Marcher isn’t just a banking trojan, it also enables the direct theft of credit card details. Plus, beyond stealing credit card info and banking details, the threat also goes after date of birth, address, and password data.<\/p>\n

How do I protect myself?<\/span><\/strong><\/h2>\n

So far, it\u2019s been reported<\/a> that this campaign has tricked almost 20,000 people into divulging their personal information. Plus, new campaigns targeting Raffeisen and Sparkasse banks are already underway. Therefore, the next step is to start thinking about protection. To ensure your personal and financial information stays secure, follow these tips:<\/p>\n