Eskenzi PR ad banner Eskenzi PR ad banner
  • About Us
Saturday, 1 April, 2023
IT Security Guru
Eskenzi PR banner
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
IT Security Guru
No Result
View All Result

More Malicious Malware Found in Google Play Store Apps

Facestealer, Joker and Coper malware has been found on several apps on the virtual marketplace.

by Guru Writer
July 19, 2022
in Cyber Bites
Phone with app store open
Share on FacebookShare on Twitter

Google has taken steps to axe dozens of malicious apps from the official Play Store that were spotted propagating Facestealer, Joker, and Coper malware families through the virtual marketplace.

Bad actors have repeatedly found ways to sneak past security barriers put up by Google in hopes of luring unsuspecting users into downloading the fraudulent apps.

On Monday, researchers Viral Gandhi and Himanshu Sharma said in a report that “Joker is one of the most prominent malware families targeting Android devices.”

“Despite public awareness of this particular malware, it keeps finding its way into Google’s official app store by regularly modifying the malware’s trace signatures including updates to the code, execution methods, and payload-retrieving techniques.”

Joker (aka Bread) is categorised as fleeceware and designed to subscribe users to unwanted paid services or make calls to premium numbers. The fleeceware also gathers user data, such as contact lists. It was first found in the Play Store in 2017.

53 Joker downloader apps have been identified by the two cybersecurity firms. It is estimated that the applications have been downloaded over 330,000 times. These apps typically pose as photo editors, emoji keyboards, and translation apps. They thrive by asking for elevated permissions.

The researchers explained the new tactic adopted by the persistent malware to bypass detection: “Instead of waiting for apps to gain a specified volume of installs and reviews before swapping for a malware-laced version, the Joker developers have taken to hiding the malicious payload in a common asset file and package application using commercial packers.”

Security researcher Maxime Ingrao last week disclosed eight apps containing a different variant of the malware called Autolycos that racked up a total of over three million downloads prior to their removal from the app store after six months.

Pieter Arntz, Malwarebytes researcher, said “what is new about this type is that it no longer requires a WebView… Not requiring a WebView greatly reduces the chances that the user of an affected device notices something fishy is going on. Autolycos avoids WebView by executing URLs on a remote browser and then including the result in HTTP requests.”

Additionally, other apps embedding Facestealer and Coper malware have been found in the official marketplace. Facestealer enables operators to siphon Facebook credentials and auth tokens. Coper, a descendent of the Exobot malware, functions as a banking trojan that can steal a wide range of user data. The malicious malware has been found in the Vanilla Camera and Unicc QR Scanner apps.

The researchers said that Coper is “capable of intercepting and sending SMS text messages, making USSD (Unstructured Supplementary Service Data) requests to send messages, keylogging, locking/unlocking the device screen, performing overly attacks, preventing uninstalls and generally allowing attackers to take control and execute commands on infected device via remote connection with a C2 server.”

Evolving tactics used by threat actors to stay under the radar help get them onto the official app store.

Users have been warned to refrain from granting unnecessary permissions to apps and to verify their legitimacy by checking reviews, developer information and reading their privacy policies.

FacebookTweetLinkedIn
ShareTweetShare
Previous Post

FBI Warn of Costly Fake Cryptocurrency Schemes

Next Post

More than 70% of organisations feel they wasted majority of their cybersecurity budget

Recent News

Data Privacy Day: Securing your data with a password manager

For Cybersecurity, the Tricks Come More Than Once a Year

March 31, 2023
cybersecurity training

Only 10% of workers remember all their cyber security training

March 30, 2023
Pie Chart, Purple

New API Report Shows 400% Increase in Attackers

March 29, 2023
Cato Networks delivers first CASB for instant visibility and control of cloud application data risk

Cato Networks Recognised as Leader in Single-Vendor SASE Quadrant Analysis

March 29, 2023

The IT Security Guru offers a daily news digest of all the best breaking IT security news stories first thing in the morning! Rather than you having to trawl through all the news feeds to find out what’s cooking, you can quickly get everything you need from this site!

Our Address: 10 London Mews, London, W2 1HY

Follow Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

This site uses functional cookies and external scripts to improve your experience.

Privacy settings

Privacy Settings / PENDING

This site uses functional cookies and external scripts to improve your experience. Which cookies and scripts are used and how they impact your visit is specified on the left. You may change your settings at any time. Your choices will not impact your visit.

NOTE: These settings will only apply to the browser and device you are currently using.

GDPR Compliance

Powered by Cookie Information