{"id":71359,"date":"2026-03-27T18:00:06","date_gmt":"2026-03-27T18:00:06","guid":{"rendered":"https:\/\/bihavadis.com\/?p=71359"},"modified":"2026-03-27T18:00:06","modified_gmt":"2026-03-27T18:00:06","slug":"kaspersky-starlink-uygulamasi-kiliginda-yayilan-yeni-bir-android-zararli-yazilim-kampanyasini-ortaya-cikardi","status":"publish","type":"post","link":"https:\/\/bihavadis.com\/index.php\/2026\/03\/27\/kaspersky-starlink-uygulamasi-kiliginda-yayilan-yeni-bir-android-zararli-yazilim-kampanyasini-ortaya-cikardi\/","title":{"rendered":"Kaspersky, Starlink uygulamas\u0131 k\u0131l\u0131\u011f\u0131nda yay\u0131lan yeni bir Android zararl\u0131 yaz\u0131l\u0131m kampanyas\u0131n\u0131 ortaya \u00e7\u0131kard\u0131"},"content":{"rendered":"<p>Kaspersky K\u00fcresel Ara\u015ft\u0131rma ve Analiz Ekibi (GReAT), siber su\u00e7lular\u0131n\u00a0<strong>BeatBanker<\/strong>\u00a0Truva at\u0131n\u0131 Starlink\u2019in Android uygulamas\u0131 maskesiyle yayd\u0131\u011f\u0131 yeni bir zararl\u0131 yaz\u0131l\u0131m kampanyas\u0131 tespit etti. Sald\u0131rganlar \u00f6ncelikli olarak Brezilya&#8217;daki kullan\u0131c\u0131lar\u0131 hedef alsa da, Kaspersky uzmanlar\u0131 di\u011fer \u00fclkelerdeki kullan\u0131c\u0131lar\u0131n da bu tehditle kar\u015f\u0131 kar\u015f\u0131ya kalabilece\u011fi konusunda uyar\u0131yor. S\u00f6z konusu Truva at\u0131, cihazlarda Monero kripto para madencili\u011fi yapmas\u0131n\u0131n yan\u0131 s\u0131ra\u00a0<strong>BTMOB<\/strong>\u00a0adl\u0131 bir uzak eri\u015fim arac\u0131 (RAT) da y\u00fckl\u00fcyor. BeatBanker, sistemde kal\u0131c\u0131l\u0131\u011f\u0131n\u0131 s\u00fcrd\u00fcrmek i\u00e7in neredeyse duyulamayacak kadar d\u00fc\u015f\u00fck seviyede s\u00fcrekli d\u00f6ng\u00fcye al\u0131nm\u0131\u015f bir ses dosyas\u0131, s\u00fcrekli d\u00f6ng\u00fcde olan bir ses dosyas\u0131 kullanan s\u0131ra d\u0131\u015f\u0131 bir mekanizmadan faydalan\u0131yor.<\/p>\n<p><strong>Kaspersky GReAT Amerika ve Avrupa Birimleri Ba\u015fkan\u0131 Fabio Assolini<\/strong><em>,\u00a0<\/em>konuya ili\u015fkin \u015fu a\u00e7\u0131klamalarda bulundu:\u00a0<em>&#8220;BeatBanker&#8217;\u0131 ilk g\u00f6rd\u00fc\u011f\u00fcm\u00fczde bir kamu hizmetleri uygulamas\u0131 k\u0131l\u0131\u011f\u0131nda yay\u0131l\u0131yor ve kripto madenciye ek olarak bir bankac\u0131l\u0131k Truva at\u0131 y\u00fckl\u00fcyordu. Ancak son tespitlerimiz, bankac\u0131l\u0131k mod\u00fcl\u00fc yerine BTMOB RAT&#8217;\u0131 devreye sokan yeni bir varyant\u0131n kullan\u0131ld\u0131\u011f\u0131n\u0131 g\u00f6steriyor. Sald\u0131rganlar, farkl\u0131 \u00fclkelerden daha fazla kurbana ula\u015fmak i\u00e7in Starlink uygulamas\u0131 gibi yeni bir &#8216;yem&#8217; kullan\u0131yor. Bu nedenle kullan\u0131c\u0131lar\u0131n tetikte olmas\u0131 ve ak\u0131ll\u0131 telefonlar\u0131n\u0131 korumak i\u00e7in geli\u015fmi\u015f g\u00fcvenlik \u00e7\u00f6z\u00fcmleri kullanmalar\u0131 kritik \u00f6nem ta\u015f\u0131yor.&#8221;<\/em><\/p>\n<p><strong>\u0130lk bula\u015fma vekt\u00f6r\u00fc<\/strong><\/p>\n<p>Kaspersky uzmanlar\u0131na g\u00f6re siber su\u00e7lular, BeatBanker Truva at\u0131n\u0131 i\u00e7eren sahte bir Starlink uygulamas\u0131n\u0131, Google Play Store\u2019u taklit eden oltalama (phishing) sayfalar\u0131 \u00fczerinden da\u011f\u0131t\u0131yor. Zararl\u0131 yaz\u0131l\u0131m bir cihaza y\u00fcklendikten sonra, kullan\u0131c\u0131ya yine Google Play\u2019i taklit eden bir aray\u00fcz g\u00f6steriyor. Bu y\u00f6ntemle sald\u0131rganlar kullan\u0131c\u0131lar\u0131 uygulama kurulum izinlerini vermeye ikna ederek ek gizli zararl\u0131 bile\u015fenlerin indirilmesine olanak tan\u0131yor.<\/p>\n<p><strong>Kripto madencili\u011fi ve BTMOB RAT mod\u00fcl\u00fc<\/strong><\/p>\n<p>Kullan\u0131c\u0131 sahte Google Play sayfas\u0131nda\u00a0<strong>UPDATE<\/strong>\u00a0d\u00fc\u011fmesine t\u0131klad\u0131\u011f\u0131nda cihazda bir\u00a0<strong>Monero kripto para madencisi<\/strong>\u00a0devreye giriyor. BeatBanker, enfekte ak\u0131ll\u0131 telefonun\u00a0<strong>pil seviyesini, cihaz s\u0131cakl\u0131\u011f\u0131n\u0131 ve kullan\u0131c\u0131 etkinli\u011fini<\/strong>\u00a0s\u00fcrekli izliyor. Bu veriler do\u011frultusunda arka planda \u00e7al\u0131\u015fan gizli kripto madencisi otomatik olarak ba\u015flat\u0131l\u0131yor veya durduruluyor.<\/p>\n<p>Android Truva at\u0131 ayr\u0131ca ele ge\u00e7irilen cihaza\u00a0<strong>BTMOB RAT<\/strong>\u00a0da kuruyor. Malware-as-a-Service (MaaS) modeliyle sat\u0131lan bu ara\u00e7, sald\u0131rganlara\u00a0<strong>cihaz \u00fczerinde tam uzaktan kontrol<\/strong>\u00a0sa\u011fl\u0131yor. BTMOB; izinleri otomatik olarak verebilme, sistem bildirimlerini gizleyebilme ve\u00a0<strong>PIN, desen ve parola gibi ekran kilidi bilgilerinin ele ge\u00e7irilmesine y\u00f6nelik mekanizmalar<\/strong>\u00a0i\u00e7eriyor. Zararl\u0131 yaz\u0131l\u0131m ayr\u0131ca sald\u0131rganlar\u0131n\u00a0<strong>\u00f6n ve arka kameralara eri\u015fmesine, GPS konumunu izlemesine ve hassas verileri s\u00fcrekli olarak toplamas\u0131na<\/strong>\u00a0olanak tan\u0131yor.<\/p>\n<p>BeatBanker, sistemden kald\u0131r\u0131lmas\u0131n\u0131 zorla\u015ft\u0131rmak i\u00e7in kal\u0131c\u0131l\u0131k mekanizmalar\u0131 da kullan\u0131yor. Zararl\u0131 yaz\u0131l\u0131m, \u00f6n planda sabit bir bildirim g\u00f6stererek ve arka planda\u00a0<strong>sessiz medya oynatma i\u00e7eren bir foreground servis<\/strong>\u00a0\u00e7al\u0131\u015ft\u0131rarak i\u015fletim sisteminin zararl\u0131 s\u00fcreci sonland\u0131rmas\u0131n\u0131 engellemeyi ama\u00e7l\u0131yor.<\/p>\n<p>Kaspersky \u00fcr\u00fcnleri bu tehdidi\u00a0<strong>HEUR:Trojan-Dropper.AndroidOS.BeatBanker<\/strong>\u00a0ve\u00a0<strong>HEUR:Trojan-Dropper.AndroidOS.Banker.*<\/strong>\u00a0olarak tespit ediyor.<\/p>\n<p><strong>Mobil tehditlere kar\u015f\u0131 korunmak i\u00e7in Kaspersky\u2019nin \u00f6nerileri<\/strong><\/p>\n<ul>\n<li>Uygulamalar\u0131 yaln\u0131zca\u00a0<strong>Apple App Store ve Google Play gibi resmi uygulama ma\u011fazalar\u0131ndan<\/strong>\u00a0indirin. Ancak resmi ma\u011fazalardan indirilen uygulamalar\u0131n da her zaman tamamen g\u00fcvenli olmayabilece\u011fini unutmay\u0131n.<\/li>\n<li>Uygulama yorumlar\u0131n\u0131 mutlaka kontrol edin, yaln\u0131zca\u00a0<strong>resmi web sitelerindeki ba\u011flant\u0131lar\u0131<\/strong>\u00a0kullan\u0131n ve uygulama zararl\u0131 \u00e7\u0131karsa bunu tespit edip engelleyebilecek\u00a0Kaspersky Premium\u00a0<strong>gibi g\u00fcvenilir bir g\u00fcvenlik \u00e7\u00f6z\u00fcm\u00fc<\/strong>\u00a0y\u00fckleyin.<\/li>\n<li>Kulland\u0131\u011f\u0131n\u0131z uygulamalar\u0131n\u00a0<strong>izinlerini dikkatle inceleyin<\/strong>. \u00d6zellikle\u00a0<strong>Eri\u015filebilirlik Hizmetleri (Accessibility Services)<\/strong>\u00a0gibi y\u00fcksek riskli izinler s\u00f6z konusu oldu\u011funda onay vermeden \u00f6nce iki kez d\u00fc\u015f\u00fcn\u00fcn.<\/li>\n<li>\u0130\u015fletim sisteminizi ve \u00f6nemli uygulamalar\u0131n\u0131z\u0131\u00a0<strong>g\u00fcncellemeler yay\u0131nland\u0131k\u00e7a g\u00fcncel tutun<\/strong>. Pek \u00e7ok g\u00fcvenlik a\u00e7\u0131\u011f\u0131, yaz\u0131l\u0131m\u0131n g\u00fcncel s\u00fcr\u00fcmlerini y\u00fckleyerek giderilebilir.<\/li>\n<\/ul>\n<p>\u00a0<\/p>\n<p>Kaynak: (BYZHA) Beyaz Haber Ajans\u0131<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Kaspersky K\u00fcresel Ara\u015ft\u0131rma ve Analiz Ekibi (GReAT), siber su\u00e7lular\u0131n\u00a0BeatBanker\u00a0Truva at\u0131n\u0131 Starlink\u2019in Android uygulamas\u0131 maskesiyle yayd\u0131\u011f\u0131 yeni bir zararl\u0131 yaz\u0131l\u0131m kampanyas\u0131 tespit etti.<\/p>\n","protected":false},"author":1,"featured_media":71360,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16],"tags":[2606,462,344,2388,7883],"class_list":["post-71359","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-teknoloji","tag-cihaz","tag-kullanici","tag-sistem","tag-uygulama","tag-zararli"],"_links":{"self":[{"href":"https:\/\/bihavadis.com\/index.php\/wp-json\/wp\/v2\/posts\/71359","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bihavadis.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bihavadis.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bihavadis.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bihavadis.com\/index.php\/wp-json\/wp\/v2\/comments?post=71359"}],"version-history":[{"count":1,"href":"https:\/\/bihavadis.com\/index.php\/wp-json\/wp\/v2\/posts\/71359\/revisions"}],"predecessor-version":[{"id":71361,"href":"https:\/\/bihavadis.com\/index.php\/wp-json\/wp\/v2\/posts\/71359\/revisions\/71361"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bihavadis.com\/index.php\/wp-json\/wp\/v2\/media\/71360"}],"wp:attachment":[{"href":"https:\/\/bihavadis.com\/index.php\/wp-json\/wp\/v2\/media?parent=71359"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bihavadis.com\/index.php\/wp-json\/wp\/v2\/categories?post=71359"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bihavadis.com\/index.php\/wp-json\/wp\/v2\/tags?post=71359"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}