Cybercriminals are adding file-encrypting features to traditional mobile banking trojans, creating hybrid threats that can steal sensitive information and lock user files at the same time.

One such trojan is called Faketoken and its primary functionality is to generate fake login screens for more than 2,000 financial applications in order to steal login credentials. The malicious app also displays phishing pages to steal credit card information, and it can read and send text messages.

Faketoken’s creators have added the ability to encrypt user files stored on the phone’s SD card sometime in July and have since released thousands of builds with this functionality, according to researchers from Kaspersky Lab.

“Once the relevant command is received, the Trojan compiles a list of files located on the device (external memory, memory card) corresponding to the given list of 89 extensions and encrypts them,” Kaspersky Lab researcher Roman Unuchek said Monday in a . “The AES symmetric encryption algorithm is used, which leaves the user with a chance of decrypting files without paying a ransom.”

.

Ransomware is a profitable business model for cybercriminals, and the number of file-encrypting programs has exploded this year. A couple of years ago, many observers had doubts that ransomware programs would begin targeting businesses on a large scale because businesses are more likely to have backup procedures in place than consumers.

That didn’t stop attackers from trying, and now every 40 seconds, a business is hit by ransomware somewhere in the world. It wouldn’t be very surprising to see the number of file-encrypting ransomware programs for mobile devices increase, too, even if mobile phones are more likely to have backups.

Android users should install applications only from the official Google Play store and should make sure that their phones don’t allow the installation of apps from unknown sources. It’s also a good idea to only download highly rated apps and to read their user reviews.