A new Android banking trojan named Snowblind was discovered that exploits the Linux kernel feature seccomp, traditionally used for security, which installs a seccomp filter to intercept system calls and bypasses anti-tampering mechanisms in apps, even those with strong obfuscation and integrity checks.  The novel attack vector allows the malware to steal login credentials, bypass 2FA, and exfiltrate data, making it highly versatile and dangerous, as it is believed that this technique has the potential to be used in many different ways to compromise apps.  Android malware traditionally exploits accessibility services to steal user input or control applications, but apps can now detect malicious accessibility services, prompting attackers to use repackaging attacks to bypass detection.  Working of Snowblind Snowblind, a new malware, leverages seccomp, a Linux kernel security feature, to create a more sophisticated repackaging attack. Unlike FjordPhantom, which uses virtualization, Snowblind injects a native library with a seccomp filter before the app’s anti-tampering code runs, which redirects system calls, making the app unable to detect tampering and allowing malicious accessibility services to operate undetected.   Seccomp is a Linux kernel functionality that allows user processes to define policies for system calls and acts as a sandboxing mechanism to reduce attack surfaces.

Source: GBHackers