Cleafy and Cyble researchers have discovered a new trojan with a “sweet” name for longtime tech enthusiasts. The developers called it Nexus after the famous Google devices, but of sweet as you can imagine, Nexus the trojan it has nothing. And although it is still in beta, the malware already has a fair number of victims, so much so that the developers are offering it to anyone interested on the dark web for rent, a mode that minimizes the risks to the “minds” and at the same time allows the “arms” to land shots with a relatively low cost.

Nexus is fond of access credentials to banking portals and cryptocurrency wallets. He reads them by infiltrating the victim’s smartphones and passes them on to the criminals, who can then dispose of the victims’ finances and assets at will. It can be rented for $3,000 a month then its qualities can be exploited which actually involve rather well-known passages: once the victim has downloaded and installed it, when he enters certain login data on a page similar to the legitimate one, Nexus reads them and send to owner, e can also send OTP codes of two-factor authentication or apps like Google Authenticator.

Nexus is in beta, so its effectiveness is destined to grow. For example, the number of supported institutes and apps will grow, now there are around 450, so it will be increasingly insidious and therefore dangerous. The Nexus code would contain some similarities with that of SOVA, another trojan greedy for banking information discovered in 2021. Cyble researchers report that so far Nexus has been also distributed in pages disguised as YouTube Vanced app sources, a third-party app that was quite well known in the past for having some additional features on YouTube. The advice is therefore always the same: watch the URLs of the pages from which you download something, and watch out for unofficial apps.