Godfather creates a “fake virtual environment” (sandbox) with vehicles such as Virtualapp and Xposedbridge on the device.
When the user opens the real application, a fake but high -tech interface appears on the screen. While the user thinks this screen is real, all login information (user name, password, PIN) is delivered to mobile pirates in real time.
This system is more developed than the old procedure “overlay attacks ;; Almost cannot be detected and offers almost “excellent imitation pages” for users.
In the fake phase, “Your application is not up to date, please update it”; Real money transfers are started in the background, the user is emptied without noticing it.
Zimperium announced that Godfather scanned more than 500 finance and crypto applications around the world and that Türkiye was in this focus and targeted 12 banks.
This virus neutralizes banking applications by using the virtualization-A-A-Weapon method.
