Mobile ransomware Svpeng is attacking customers through social engineering text messages, according to security firm McAfee.
The malware is said to trick victims into divulging their passwords, before searching for banking apps from the likes of Citigroup, American Express and Wells Fargo, and then locking the device and demanding payment.
Lianne Caetano, director of product marketing at McAfee, said: "Up until now, most financial organizations operated under the guise of ‘ignorance is bliss’ with regard to educating users and employees about the importance of safe mobile security habits.
"While users are certainly much more comfortable with checking account balances and depositing checks remotely than they were 10 years ago, oftentimes along with comfort comes complacency — and that can be detrimental to your online safety."
Hackers are said to demand $200 USD in payment through reloadable Green Dot MoneyPak cards before releasing the device, but McAfee fear that attacks may grow more ambitious, eventually leading to the theft of bank credentials.
Users are warned not to respond to anonymous text messages, to avoid public Wi-Fi networks when banking, and not to download apps from third-party stores.
