Clubhouse, the audio-based chat platform, has gained massive popularity in the last few weeks, but sadly, the application is currently limited to iOS devices. Though the company has announced its plans to expand Clubhouse to Android smartphones, the availability details remain unclear. However, ahead of the official launch, an imposter Clubhouse app for Android has appeared on the internet containing a trojan – nicknamed “BlackRock.” The malware spotted by Ireland-based ESET researcher Lukas Stefanko seemingly gains unauthorised login credentials from more than 450 apps and can bypass SMS-based two-factor authentication. In a blog post, the researcher adds that the “malicious package” is served from a website that has the look and feel of the genuine Clubhouse website. The website essentially allows users to download the Android Package Kit or APK file.

The imposter Clubhouse for Android target list includes well-known financial and shopping apps, cryptocurrency exchanges, and social media platforms. For starters, Twitter, WhatsApp, Facebook, Amazon, Netflix, Outlook, eBay, Coinbase, Plus500, Cash App, BBVA and Lloyds Bank are all on the list, ESET notes. In other words, as soon as the user launches one of the targeted applications, the BlackRock  malware will create a “data-stealing overlay of the application and request the user to log in.” In this case, the user hands over their credentials to the cybercriminals instead of logging in. The security firm adds that SMS-based two-factor authentication (2FA) to help prevent anyone from infiltrating accounts would not help in this case since the BlackRock malware can also intercept text messages.