Android Malware Archives

PromptSpy Android Malware Abuses Gemini AI to Automate Recent-Apps Persistence

20Feb

By RBNo Comments

News

PromptSpy Android Malware Abuses Gemini AI to Automate Recent-Apps Persistence

Cybersecurity researchers claim to have found the first Android virus that achieves persistence by abusing Google's generative artificial intelligence (AI) chatbot, Gemini, as part of its execution loop. ESET has given the virus the code name PromptSpy. The malware can take screenshots, record screen activity as video, collect device information, intercept lockscreen data, and prevent uninstallation attempts. In a report released today, ESET researcher Lukáš Štefanko stated that Gemini is used to examine the current screen and give PromptSpy detailed instructions on how to make sure the malicious app stays pinned in the list of recent apps, preventing it from being easily swiped away or eliminated by the system. Using generative AI allows the threat actors to adapt to almost any ...

Hugging Face abused to spread thousands of Android malware variants

30Jan

By RBNo Comments

News

Hugging Face abused to spread thousands of Android malware variants

The Hugging Face platform is being used by a new Android malware campaign to store thousands of permutations of an APK payload that gathers login details for well-known financial and payment services. A well-known platform called Hugging Face contains and disseminates models, datasets, and applications related to machine learning (ML), artificial intelligence (AI), and natural language processing (NLP). It is considered a trusted platform unlikely to raise security alarms, but bad actors have abused it in the past to host malicious AI models. Researchers at the Romanian cybersecurity firm Bitdefender have uncovered a campaign that uses the platform to spread Android malware. The assault starts by tricking victims into installing a dropper program called TrustBastion, which emp...

Android Malware Operations Merge Droppers, SMS Theft, and RAT Capabilities at Scale

22Dec

By RBNo Comments

News

Android Malware Operations Merge Droppers, SMS Theft, and RAT Capabilities at Scale

In mobile assaults against consumers in Uzbekistan, threat actors have been seen using malicious dropper apps that pose as trustworthy apps to deliver an Android SMS stealer known as Wonderland. According to a research released last week by Group-IB, users used to receive "pure" Trojan APKs that functioned as malware as soon as they were installed. These days, more and more enemies use droppers that pose as trustworthy apps. Although the dropper appears innocuous at first glance, it has a malicious payload that is installed locally even in the absence of an active internet connection. The Singapore-based cybersecurity firm claims that Wonderland (previously WretchedCat) enables bidirectional command-and-control (C2) communication to carry out commands in real-time, enabling arbitrar...

Cellik Android malware builds malicious versions from Google Play apps

17Dec

By RBNo Comments

News

Cellik Android malware builds malicious versions from Google Play apps

On underground cybercrime forums, a new Android malware-as-a-service (MaaS) called Cellik is being promoted. It offers a wide range of features, including the ability to integrate it into any Google Play Store app. In particular, attackers can choose apps from the official Android app store and make trojanized versions that look reliable while maintaining the functionality and design of the original program. Cellik infections can remain undetected for a longer period of time by offering the anticipated capabilities. Furthermore, the supplier asserts—though this is unverified—that packaging the virus in this manner might assist get beyond Play Protect. Cellik, which costs $150 per month or $900 for lifetime subscription, was found on underground forums by mobile security company i...

Google nukes 224 Android malware apps behind massive ad fraud campaign

17Sep

By RBNo Comments

News

Google nukes 224 Android malware apps behind massive ad fraud campaign

After 224 rogue apps on Google Play were used to create 2.3 billion ad requests daily, a huge Android ad fraud operation known as "SlopAds" was shut down. The Satori Threat Intelligence team at HUMAN found the ad fraud scheme, stating that the apps had been downloaded more than 38 million times and used steganography and obfuscation to hide the harmful activity from Google and security tools. Users from 228 countries installed the apps as part of the global campaign, and SlopAds traffic generated 2.3 billion bid requests daily. The United States accounted for the largest percentage of ad impressions (30%), followed by Brazil (7%), and India (10%). Researchers called this operation 'SlopAds' because the threat-related apps appear to be mass-produced, similar to 'AI slop', and beca...

New Android Malware Surge Hits Devices via Overlays Virtualization Fraud and NFC Theft

20Jun

By RBNo Comments

News

New Android Malware Surge Hits Devices via Overlays Virtualization Fraud and NFC Theft

The inner workings of AntiDot, an Android malware that has penetrated over 3,775 devices as part of 273 distinct attacks, have been made public by cybersecurity researchers. In a report sent to The Hacker News, PRODAFT stated that AntiDot, which is run by the financially driven threat actor LARVA-398, is regularly offered for sale as a Malware-as-a-Service (MaaS) on underground forums and has been connected to numerous mobile campaigns. AntiDot is marketed as a "three-in-one" solution that can intercept SMS messages, record the device's screen by abusing Android's accessibility services, and get private information from third-party apps. Based on activity that suggests selective victim targeting by language and location, it is assumed that the Android botnet was distributed using...

New Android malware steals your credit cards for NFC relay attacks

22Apr

By RBNo Comments

News

New Android malware steals your credit cards for NFC relay attacks

'SuperCard X' is a new malware-as-a-service (MaaS) platform that targets Android smartphones through NFC relay attacks that use hijacked credit card data to facilitate ATM and point-of-sale transactions. The open-source project NFCGate and its malicious offspring, NGate, which has enabled attacks in Europe since last year, share code with SuperCard X, which is associated with Chinese-speaking threat actors. Telegram channels that provide direct customer support are used to advertise the malware-as-a-service platform. The mobile security company Cleafy found SuperCard X and states that it has seen assaults using this Android malware in Italy. Multiple samples with minor variations were used in these attacks, suggesting that affiliates are given the choice of custom builds made to ...

New Android Trojan Crocodilus Abuses Accessibility to Steal Banking and Crypto Credentials

31Mar

By RBNo Comments

News

New Android Trojan Crocodilus Abuses Accessibility to Steal Banking and Crypto Credentials

Researchers studying cybersecurity have found Crocodilus, a new financial malware for Android that is especially intended for customers in Spain and Turkey. Using cutting-edge tactics like remote control, black screen overlays, and sophisticated data collection via accessibility logging, Crocodilus comes into the picture not as a mere clone but as a full-fledged threat right away, according to ThreatFabric. The software is meant to enable device takeover (DTO) and eventually carry out fraudulent transactions, just like other banking trojans of its kind. The malware's programmer speaks Turkish, according to an examination of the source code and debug messages. The Dutch mobile security firm examined Crocodilus artifacts that pose as Google Chrome read more about New Android Trojan...

Hackers Use .NET MAUI to Target Indian and Chinese Users with Fake Banking, Social Apps

25Mar

By RBNo Comments

Business

Hackers Use .NET MAUI to Target Indian and Chinese Users with Fake Banking, Social Apps

Researchers studying cybersecurity are drawing attention to a campaign of Android malware that uses Microsoft's.NET Multi-platform App UI (.NET MAUI) framework to produce fake social media and banking applications aimed at Chinese and Indian users. According to Dexter Shin, a researcher at McAfee Labs, these malware pose as trustworthy apps in order to target users and steal confidential data. Microsoft's cross-platform desktop and mobile app framework,.NET MAUI, allows developers to use C# and XAML to create native applications. With the ability to not only build multi-platform apps with a single project but also add platform-specific source code when needed, it is an advancement beyond Xamarin. It's important to note that the tech giant encouraged developers to switch to.NET MA...

Android malware found on Amazon Appstore disguised as health app

20Dec

By RBNo Comments

News

Android malware found on Amazon Appstore disguised as health app

'BMI CalculationVsn' is a malicious Android spyware app that was found on the Amazon Appstore. It poses as a straightforward health tool while secretly collecting data from compromised devices. Researchers from McAfee Labs found the app and alerted Amazon, which resulted in the software being taken down from the marketplace. To get rid of any remaining traces, anyone who installed the software must manually uninstall it and run a complete scan. Amazon Fire tablets and Fire TV devices come with the Amazon Appstore pre-installed. It is a third-party app store for Android smartphones read more Android malware found on Amazon Appstore disguised as health app. Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of t...