New Vultur malware is spreading via the Google Play Store. Malware intercepts login details for online banking and cryptocurrency applications by recording device’s screen.

According to experts from ThreatFabric, Vultur monitors the screen of the device after launching the online banking application. This is possible thanks to an overlay that looks like the user interface of the actual banking application. The victims are convinced that they are entering the data into the actual app, while in fact they pass it to the scammers. According to the experts, malware is able to apply a window overlay to over 100 official applications of banks and supported wallets.

According to the dobreprogramy portal, attempting to remove Vulture on your own is difficult, as it bases its actions on the accessibility services built into the operating system. The moment the victim tries to access the details of the application in the Android settings, the malware automatically clicks the back button, thus blocking access to the uninstall button.