What is Nexus Banking Trojan
Nexus is the name of a banking trojan that targets Android devices in order to extract banking and finance-related information. According to the detailed research conducted by Cyble, this trojan is assumed to be a rebranded version of the S.O.V.A trojan which has similar capabilities. As a rule, banking trojans acquire access to the targeted device by disguising themselves as legitimate apps and asking users to enable Android Accessibility Services in order to use the app’s features or the app itself. Unfortunately, if permissions like this get enabled for trojanized apps, they will misuse them to grant additional permissions, prevent users from disabling them, and turn off various security measures like Google Play Protect. It is known that Nexus targets over 40 popular banking applications. To force users into entering sensitive information (e.g., passwords, passcodes, IDs, usernames, etc.), the virus downloads the appropriate HTML injection code to create a fake overlay of a specific bank app that a victim is using. This way users enter their log-in credentials without suspecting they could be recorded and sent to the cybercriminals’ servers afterward.
While this might be the primary function of Nexus trojan, it has access to features that can be abused maliciously. It can record keystrokes, manage and manipulate SMS messages, calls, and notifications, read two-factor authenticators, delete installed apps, generate fake screens, lock/unlock the device, and even collect information from cryptocurrency wallets (if one is used). In addition, it may also install other malicious content onto third-party devices. For instance, if a user connects his/her phone infected by Nexus to a computer, the trojan may inject some devastating virus like ransomware in order to run encryption of data. Thus, the presence of Nexus can lead to severe consequences, such as privacy issues, financial losses, and even identity theft. If you suspect that your Android device might be infected with Nexus or other similar malware, follow our guide below to remove it, immediately.
How Nexus Banking Trojan infected your smartphone
As mentioned, banking trojans are often distributed via disguised trojanized apps that are downloaded from malicious pages. However, because Nexus can be purchased and used by other cybercriminals within the fraudulent community, different threat actors may use also different trojanized apps (or even other ways) to distribute the virus.
One example of Nexus precipitation has been reported to occur via the app called YouTube Vanced. Initially, this app is fully legitimate and is promoted as an advanced version of YouTube with various useful features (adblocking, background playback, etc.) that are available only in YouTube Premium. However, cybercriminals created a malicious copy of this app to conceal Nexus Trojan inside. Links to downloading this malicious clone can therefore be promoted through unofficial/untrustworthy pages, shady ads, phishing e-mail or SMS messages that fool users into clicking on suspicious links or downloading malicious attachments, and other kinds of channels as well.
In addition, it is also worth mentioning that trojan-hiding apps can sometimes squeak to legitimate markets like Play Store, Galaxy Store, etc., and be hosted there for some amount of time until it gets removed by admins. Thus, you should download only trusted and time-tested software that has not been spotted on any malicious radars, even on legitimate platforms like Play Store or similar ones.
1. Download Anti-malware software
The best and most effective way to detect and remove malicious software is to use a specially designed program like antivirus. High-quality and trusted anti-malware software wields constantly updating databases of malware to find it and neutralize quickly. Manual removal may not be as effective as using anti-malware software. The virus may show reluctance to the deletion or otherwise leave redundant traces. Our strong recommendation is Norton Security which has been providing thorough protection and removal of various threats across smartphone operating systems. You can download it from Google Play for Android and run malware removal for free.
2. Manual removal
If you do not have any of the above-listed applications installed, but still experience the same symptoms of Nexus Trojan, use these instructions to find the culprit. There are two traditional ways to do it. Both include checking the amount of battery and data resources demanded by the app. If there is a malicious program installed on your device, you will see excessively high resource demand by the malware. The steps listed below are similar on all Android-based smartphones.
To check Battery resources:
- Find and open Settings on your device.
- Among the list of settings, choose Battery.
- Then tap on Battery Usage and check which application consumes the most (on top of the list).
To check data usage:
- Open Settings as we did above.
- Then choose something related to the network. Usually, it is called Connections.
- Find and tap on Data Usage or similar. On some devices, you will see the overall usage of traffic immediately. If not, you have to choose WiFi and Mobile data usage separately.
After identifying which app causes the most resource consumption, you can navigate to Settings > Applications, find and delete the application you found. Before doing so, it higly-recommended to remove Administrative Privileges for the malicious app:
- Go to Settings and find the Lock Screen and Security configuration.
- Most smartphones have Advanced or Other security settings to open.
- Then you should select something called Device Admin Apps.
- Once done, find the malicious application you found before and Deactivate it.
If you are still unable to delete the stubborn app, we advise you to do it in Safe Mode. It ensures your smartphone is launched using only in-built and native features, which helps work around restrictions imposed by malicious software. Of course, Nexus Trojan could block it as long as it has privileged rights, but still, give it a try if you have not done it yet. Here is how:
- Push and hold the Power button until it opens the list of reboot options.
- Then tap on and hold the Power off icon for a couple of seconds.
- A new message will pop asking to boot in Safe Mode.
- Confirm it and boot up your smartphone to affect the above steps in Safe Mode.
Once the deletion steps have been performed, you should no longer encounter the symptoms of the malicious Nexus Trojan. We recommend you scout the list of installed applications for other suspicious presence that you do not remember installing. There is a chance Nexus Trojan could install it upon.
3. Reset browser settings
After removing the application completely, it is important to clear your browser from malicious settings that could be installed by Nexus Trojan. You will have to perform a couple of steps comprising full restoration of browser settings. Besides infecting your device, the virus could also crawl into your browser to impose various changes. For instance, content like push notifications and other types of banners popping right on the screen might come from your browser. You can run a step-by-step cleaning for each browser segment (browsing history, push-notifications, permissions. etc.) to remove any malware traces. However, rolling browser configuration back to factory settings is better because it wipes out everything accumulated inside of a browser making sure no unwanted content dwells around your smartphone. We will show you both step-by-step clean-ups and full factory reset for the most popular browsers including Google Chrome, Mozilla Firefox, and Opera.
At first, let’s clear browsing data.
- Open Chrome browser and tap on Menu (3-dot icon in the top right corner).
- Then go to History and choose Clear browsing data….
- In the Advanced tab check all boxes and tap Clear data.
Then, we should disable push notifications.
- Open the same Menu and choose Settings.
- Then find and open Site Settings.
- Scroll down a bit until you find Notifications.
- Locate websites under Allowed, tap on them, and choose Clear & Reset.
- You can also disable the Notifications feature to prevent websites from asking for permission completely.
As mentioned, you can also reset your browser to default settings so that you have it from scratch. This means that all of the data stored within the browser will be deleted and rolled back to the default configuration. Since we are dealing with malicious behavior, it is good to perform such steps to make sure nothing harmful persists inside of your browser. It is more robust and quicker than running each step like above.
- Find and open Settings on your screen.
- Go to Applications and search for Chrome.
- Once found, tap on it and navigate to Storage > Manage Storage.
- Finally, tap on Clear All Data and wait until the process is done.
The process looks almost identical, only slightly different in the names of the steps. Nevertheless, we will show you how it looks like on Firefox as well. To clear browsing data:
- Open Firefox and navigate to Menu likewise in Chrome.
- Choose History and tap on Clear private data.
- Select all of the entries and tap Clear Data.
To disable push notifications, follow these steps.
- Open Firefox again.
- Open Menu (either on top or below) and choose Settings.
- Then, go to Site permissions > Notification.
- Choose Blocked to not see notifications at all.
Up next is resetting browsing settings completely. To do this, simply follow all of the steps mentioned for Chrome above.
Clearing browsing data in Opera looks like this:
- Open Opera and tap on the browser logo below on the right.
- Choose Settings, scroll down the list, and tap on Clear browsing data….
- Click Advanced, check all of the boxes listed, and choose Clear Data.
In order to disable notifications in Opera:
- Open Opera and tap on the browser logo below on the right.
- Choose Settings and scroll down until you find Site Settings.
- Click on it and choose Notifications.
- Tap Block to remove all Notification permission.
Performing full Opera reset equals to what we mentioned in instructions for Chrome.
4. Perform a Factory Reset
If you continue to stumble upon weird smartphone behavior and suspect the virus is not deleted, the best solution is resetting the device itself. This step will remove all the data stored on your system and roll all configuration settings back to the default state. In other words, you will reinstall your system from scratch. This will delete the virus and clean your smartphone from other unnecessary stuff in case you have not cleaned it for a very long time. Before doing so, make sure there is no important data to lose. It is also worth jotting the names of Google accounts and other services because most people tend to forget them throughout their usage. After performing the Factory Reset, you will have to log in to all of your user accounts once more. Now you are ready to dive into resetting your device.
- Open Settings and go to About phone.
- Right there, you will see information about Android and UI versions, your CPU, RAM, Memory, and more.
- Somewhere at the bottom, you will see the Reset button. Click on it and choose Factory Reset to erase all data and get your smartphone back to default settings.
- Agree with everything promoted and wait until your device completes the reset. It might take 30 minutes or close.
- Also, if you do not have the same location of settings and unable to find some of these steps, you can type Reset being in Settings and open it up.
In fact, you can find any setting you need using the search. It is our responsibility to provide detailed instructions so you have a full picture of the entire process.
We hope the instructions above were helpful, and you were able to eliminate all traces of Nexus malware from your Android device and secure it. The provided tutorial is general and based on common malware detection and removal techniques. If you have any questions or additional information on the topic, please, share your thoughts in the comment section below.