Hidden Spyware downloaded over 400 million times on Android devices via Google Play - Cyber and Fraud Centre

Description

The malicious spyware module is disguised as a developer tool and has infiltrated countless Android apps and games on the Google Play store. Operating covertly, this module remains hidden within these seemingly harmless applications.

Once activated, the malicious module secretly connects to a command-and-control server (C2) and sends a vast amount of information about the infected device. This data includes information from various sensors embedded within the device, such as the gyroscope and magnetometer. This helps the criminals controlling the malware to figure out if it’s running on an actual device or just a simulated one on a computer. The C2 server responds by sending a list of web addresses (URLs) to the module, which then discreetly opens these URLs within a hidden web browser, displaying intrusive advertising banners.

The malicious module also gives additional capabilities to the JavaScript code executed on web pages featuring advertisements.

Researchers found that it adds many new features to the code, such as the ability to:

Retrieve a comprehensive list of files located in specific device folders.
Verify the existence of particular files or folders on the device.
Retrieve files from the device.
Manipulate or replace the contents of the device’s clipboard.

The hackers behind this malware can use these powers to gather sensitive information and files from the victim’s device. For example, they can access files accessible to apps containing a particular type of spyware. By incorporating malicious code into the advertisement banners’ web pages, the attackers can effortlessly steal files accessible to apps containing this specific strain of spyware.

The security experts at Doctor Web found this malicious module and several different versions in many apps available on Google Play. While some apps still harbour this malicious module, others contain it solely within specific versions or have been entirely removed from the app store. Researchers have identified this malware in 101 apps with a combined total of at least 421,290,300 downloads.

Researchers believe that millions of Android device owners are at risk of being victims of cyber spying. They promptly shared their findings with Google to help protect users and safeguard them against this dangerous threat.

A screenshot of a video editorDescription automatically generated with medium confidence