Zeus Trojan Steals Bank Info From Android Phones

A new computer virus has targeted Android phones and it could affect your bank account.

The Zitmo virus (ZeuS in Mobile) poses as a banking activation application and once installed begins forwarding all SMS texts to a remote web server.

The virus takes the one-time activation codes that banks send to mobile phone users and sends it to the web server. Once at the web server, criminals could potentially empty bank accounts.

In the background, it listens to all incoming SMS messages and forwards them to a remote Web server, Axelle Apvrille said. It's simple, but just enough for the ZeuS gang to grab your banking mTANs.

mTans are the one-time authentication passwords that banks use to authorize financial transactions. They are believed to be extra secure as they require two-way authentication. But that doesn't stand much of a chance when hackers already have the username and password and are able to forward all SMS messages to a remote server.

Apvrille, a researcher at the security firm Fortinet, was the first to discover that ZeuS had made its way onto the Android. In the past, a version of the virus has attacked Windows 7, Blackberrys, and other electronics.

This is just another virus to finally make its way over to the Android operating system. In May IT company Juniper Networks discovered that malware targeting Androids had increased by 400 percent in the last year. It also noticed that it was increasingly susceptible to Wi-Fi attacks.

A new version of the DroidDream Trojan was also recently found targeting Android systems. Lookout Security found that the DroidDream, which had already been removed from Android's Marketplace, had somehow made its way back in and downloaded by 1000 to 5000 people. Before this recent appearance, the Trojan had been found within Androids in March and June.

The viruses were able to make it on to the marketplace as Google allows for any user to put applications. Google relies on users to flag malicious material to be taken down, though likely after some users have already been affected.