Exposed! McAfee Escobar malware stealing passwords from your phone. Stop Trojan in just 6 steps

The Escobar malware has been found stealing passwords from phones,even from SMS text messages! Malware masquerades as McAfee antivirus app.

Know how to protect your passwords from Escobar malware on your phone. (Pixabay)

In a shocking expose, a new Android banking Trojan named "Escobar" has been found stealing one-time codes from Google Authenticator! This was considered as being impossible and yet, this banking Trojan is doing exactly that. What is shocking is that the Escobar malware is impersonating McAfee antivirus app. The malware is hidden inside an app found on Google Play Store and unsuspecting people have downloaded it only to suffer loss. The app not only steals SMS text messages, media files, but controls phone calls, tracks location, uses the phone's camera, uninstalls apps, injects new URLs into web browsers and, most devastating of all, uses the VNC remote-desktop function.

The malicious app has been spotted by Bug slayer MalwareHunterTeam. They spotted a fake McAfee app a couple of weeks ago and found that the Android package was named as "com.escobar.pablo." Pablo Escobar was a Colombian drug lord who was killed in 1993.

The trojan app was downloaded from the Discord content-delivery network CDN.

This McAfee Escobar malware can even break into your online bank accounts as well as other online services like email and social-media accounts. Hence, it is advised to stay alert and don't download any app from any third party source and even if you download some app from Google Play Store, do verify it thoroughly. Here's how you can protect yourself from Escobar malware

How to protect your phone from Escobar malware

1. Get Android antivirus app on your phone.

2. Avoid installing apps from outside the Google Play store or any suspicious app.

3. Use the strongest two-factor-authentication (2FA) method. Using a USB security key is the best option.

4. Read the permissions carefully that app requests before installing it.

5. Make sure Google Play Protect is turned on.

What to do if you suspect that you've been infected with Escobar malware

If you suspect that your mobile phone has been infected by a banking Trojan such as Escobar, Cyble, here's what you can do

1. Backup your media files only, not your apps.

2. Turn off your mobile data and Wi-Fi.

3. Remove your SIM card.

4. Factory-reset your phone.

5. Use your Google account to restore as much of your personal data.

6. Check your bank balance for any suspicious activity, and report it to your bank if you find some.