Experts of the anti-virus company Doctor Web warned about the spread of the banking Trojan program BankBot. It manages the infected smartphones and steals confidential information.

Currently, the threat is real for users from dozens of countries, experts say.

BankBot is distributed under the guise of innocuous applications - for example, Adobe Flash Player. After infection, the Trojan opens a window with the requirement to give it access to special capabilities (Accessibility Service). In this mode, designed for users with disabilities, programs can independently click on virtual buttons in dialog boxes and system menus. For mobile malicious applications, this is an unusual functionality.

After the user is forced to allow BankBot access to special features, the Trojan independently obtains administrator rights (by "clicking" on the necessary buttons in the settings). The user may not even notice this, because the process is very fast.

Subsequently, if the owner of the smartphone tries to limit the virus access to advanced features, BankBot will return them back.

In the course of its activities, BankBot collects information about applications being launched and user actions in them, and steals all logins and passwords that the user enters on any sites and applications. In addition, the virus can display fake windows to enter online banking systems, payment systems and the Google Play store.