Operation Poisoned News: Hong Kong Users Targeted With Mobile Malware via Local News Links

  • Posted on:March 24, 2020 at 5:01 am
  • Posted in:Malware, Mobile
  • Author:
    Trend Micro

A recently discovered watering hole attack has been targeting iOS users in Hong Kong. The campaign uses links posted on multiple forums that supposedly lead to various news stories. While these links lead users to the actual news sites, they also use a hidden iframe to load and execute malicious code. The malicious code contains exploits that target vulnerabilities present in iOS 12.1 and 12.2. Users that click on these links with at-risk devices will download a new iOS malware variant, which we have called lightSpy.

Read More
Tags: androiddmsSpyiOSlightSpyOperation Poisoned News

Dissecting Geost: Exposing the Anatomy of the Android Trojan Targeting Russian Banks

  • Posted on:March 5, 2020 at 3:58 am
  • Posted in:Malware, Mobile
  • Author:
    Vit Sembera (Threats Analyst)

We dug deeper into the behavior of Geost, a trojan targetting Russian banks, by reverse engineering a sample of the malware. The trojan employed several layers of obfuscation, encryption, reflection, and injection of non-functional code segments that made it more difficult to reverse engineer.

Read More
Tags: androidGeostMalwareRussianTrojan

Malicious Optimizer and Utility Android Apps on Google Play Communicate with Trojans that Install Malware, Perform Mobile Ad Fraud

  • Posted on:February 6, 2020 at 4:41 am
  • Posted in:Malware, Mobile
  • Author:
    Lorin Wu (Mobile Threats Analyst)

We recently discovered several malicious optimizer, booster, and utility apps (detected by Trend Micro as AndroidOS_BadBooster.HRX) on Google Play that are capable of accessing remote ad configuration servers that can be used for malicious purposes, perform mobile ad fraud, and download as many as 3,000 malware variants or malicious payloads on affected devices.

Read More
Tags: androidgoogle playmalicious appsMobile Ad Fraud

First Active Attack Exploiting CVE-2019-2215 Found on Google Play, Linked to SideWinder APT Group

  • Posted on:January 6, 2020 at 5:00 am
  • Posted in:Exploits, Mobile
  • Author:
    Trend Micro

We found three malicious apps in the Google Play store that work together to compromise a victim’s device and collect user information. One of these apps, called Camero, exploits CVE-2019-2215, a vulnerability that exists in Binder (the main Inter-Process Communication system in Android). This is the first known active attack in the wild that uses the use-after-free vulnerability.

Read More
Tags: appAPTgoogle play

Mobile Cyberespionage Campaign Distributed Through CallerSpy Mounts Initial Phase of a Targeted Attack

  • Posted on:December 2, 2019 at 5:31 am
  • Posted in:Bad Sites, Mobile
  • Author:
    Ecular Xu (Mobile Threat Response Engineer)

We found a new spyware family disguised as chat apps on a phishing website. We believe that the apps, which exhibit many cyberespionage behaviors, are initially used for a targeted attack campaign. We first came across the threat in May on the site http://gooogle.press/, which was advertising a chat app called “Chatrious.” Users can download the malicious Android application package (APK) file by clicking the download button indicated on the site.

Read More
Tags: androidAPKcyberespionagespyware