South Korea's Financial Security Institute reported Monday that its red-team contractors cloned mobile banking certificates on 11 of 22 test Android phones using overlay malware sideloaded outside official stores, a failure rate that prompted the body to recommend hardware-backed keys industry-wide by March 2027.
Attack path
Testers posed as coupon apps on third-party markets. Once installed, the malware drew fake login layers atop legitimate banking apps, captured one-time passwords, and exported certificate files to an attacker-controlled server within four minutes. iOS devices in the same exercise resisted cloning unless jailbroken.
Bank responses
Woori Financial Group and Hana Financial Group said they would accelerate rollout of app shielding upgrades already scheduled for December. KakaoBank, which lacks legacy PC banking, pledged to block sideloaded certificate exports entirely on Android 15 handsets starting next month.
The Financial Supervisory Service ordered institutions to file remediation timelines within 30 days. It stopped short of fines, citing voluntary participation in the exercise, but warned that repeat failures in 2027 would trigger on-site inspections.
Consumer guidance
Korea Internet and Security Agency published a checklist urging users to install only from Google Play or Galaxy Store, disable "install unknown apps," and rotate security numbers after any overlay prompt that flickers during login. Telecom carriers agreed to push the alert as a free SMS blast Tuesday.
Why timing matters
Mobile transfers above 10 million won per day have doubled since the pandemic, and prosecutors are juggling multiple voice-phishing cases tied to certificate theft. FSI executives said they will repeat the drill quarterly and publish anonymized vendor scores to spur competition among app-security startups.
Historical breaches that shaped the test
Certificate cloning featured in several 2024 voice-phishing convictions, including a Gangnam ring that moved 12.8 billion won before banks patched overlay detection. FSI modeled those cases when designing scenarios, adding social-engineering calls that pressured testers to sideload fake security updates.
Smaller mutual savings banks, which often rent white-label apps, scored worst in the exercise. FSI said it will subsidize penetration tests for institutions with fewer than two million mobile users so they can catch up without passing costs to rural depositors.
Hardware-backed roadmap
Samsung and LG phone divisions pledged tighter integration with banking apps through Knox and embedded secure elements, though older handsets will remain vulnerable until users upgrade. Regulators are weighing whether to require hardware keys for transfers above 5 million won, a threshold banks argue would crush legitimate small-business payroll runs unless phased in slowly.
International comparison
FSI researchers cited European Banking Authority exercises that found similar overlay success rates on older Android builds, arguing Korea is not alone in facing sideload risk. They recommended harmonizing test cases with Japanese FISC drills scheduled for January so vendors can certify apps once for multiple markets.
Mobile carriers SK Telecom and KT said they would preload government anti-overlay warnings on new handsets starting in December, complementing bank-side controls. Apple Korea noted iOS sideloading restrictions remain strict but urged users to enable stolen-device protection features added in the latest update.
Phishing overlap
Police data show 62 percent of voice-phishing losses this year involved stolen certificates or OTP captures, reinforcing why FSI paired malware tests with social-engineering scripts. Banks will embed the institute's checklist into customer onboarding flows starting next quarter, including animated tutorials on spotting overlay flicker.