What is a malicious Web app that masquerades as a useful program?
|
on April 7, 2022, 6:38 AM PDT Malicious Android apps found masquerading as legitimate antivirus toolsThe phony apps attempted to deliver malware designed to steal account credentials and banking information, Check Point Research says. Mobile users who download an antivirus app naturally expect the program to protect their device. But several Android apps analyzed by Check Point Research did the exact opposite. In a report released Thursday, the cyber threat intelligence provider detailed its discovery of six apps in Google Play that appeared to be antivirus software but actually tried to install malware capable of stealing credentials and financial data. Disguised as genuine antivirus products, the apps in question packed a lethal payload dubbed Sharkbot. Beyond trying to steal sensitive information, this brand of malware attempts to skirt past detection by using various evasion techniques. In particular, it takes advantage of a tactic known as domain generation algorithm. In this scenario, cybercriminals continually create new domain names and IP addresses for their command and control servers, making it difficult for authorities to cut off the connection between the attackers and infected machines. Sharkbot works by prompting its victims to enter account credentials in windows that look like legitimate input forms. Any usernames and passwords entered this way are sent to a malicious server where the attackers can use them directly for account compromise or sell them on the Dark Web. The malware also attempts to coax users to grant permission for the accessibility service, allowing it to control the device. From there, the attackers can send out notifications that contain malicious links. Upon discovering the malicious apps, Check Point informed Google, which removed them from its app store. Four of the apps came from three developer accounts, two of which were active in the fall of 2021. Despite the removal from Google Play, certain apps linked to these accounts remain available in unofficial app stores, a sign that the attacker may be aiming to stay under the radar but still ensnare potential victims. SEE: Top Android security tips (free PDF) (TechRepublic) More than 15,000 downloads of the malicious apps were detected by Check Point, mostly targeting the UK and Italy. But by using a geofencing fencing feature to determine a victim’s location, the apps purposely ignored targets in China, India, Romania, Russia, Ukraine and Belarus. “The threat actor strategically chose a location of applications on Google Play that have users’ trust,” Check Point Software research & innovation manager Alexander Chailytko said in a press release. “What’s also noteworthy here is that the threat actors push messages to victims containing malicious links, which leads to widespread adoption. All in all, the use of push messages by the threat actors requesting an answer from users is an unusual spreading technique. I think it’s important for all Android users to know that they should think twice before downloading any antivirus solution from the Play Store. It could be Sharkbot.” To help protect individuals and organizations from these types of malicious apps, Check Point provides a few tips:
Also See
What is a malicious program that is disguised as a useful program?Trojan. A Trojan disguises itself as desirable code or software. Once downloaded by unsuspecting users, the Trojan can take control of victims' systems for malicious purposes.
What programs are malicious?Types of malware include computer viruses, worms, Trojan horses, ransomware and spyware. These malicious programs steal, encrypt and delete sensitive data; alter or hijack core computing functions and monitor end users' computer activity.
What is the most malicious software?What Are the Most Common Types of Malware Attacks?. 1) Adware.. 2) Fileless Malware.. 3) Viruses.. 4) Worms.. 5) Trojans.. 6) Bots.. 7) Ransomware.. 8) Spyware.. What malware masquerades as a legitimate program but contains malicious programs which could damage a computer?Trojans masquerade as legitimate programs, but they contain malicious instructions. They've been around forever, even longer than computer viruses, but have taken hold of current computers more than any other type of malware. A Trojan must be executed by its victim to do its work.
|
