Wednesday, January 22, 2025
HomeAndroidNew Android Malware SpyAgent Taking Screenshots Of User's Devices

New Android Malware SpyAgent Taking Screenshots Of User’s Devices

Published on

SIEM as a Service

Follow Us on Google News

SpyAgent, a newly discovered Android malware, leverages OCR technology to extract cryptocurrency recovery phrases from screenshots stored on infected devices. 

By stealthily capturing screenshots, the malware bypasses traditional security measures that rely on text-based detection, which allows it to efficiently identify and exfiltrate sensitive information, posing a significant threat to cryptocurrency users.

Cybercriminals are employing a phishing tactic to steal cryptocurrency. They send text messages luring users to download malicious apps that, once installed, capture screenshots of users’ cryptocurrency wallet recovery phrases.

These phrases are often stored as screenshots for quick reference and are essential for recovering lost wallets. 

If compromised, attackers can access these wallets and drain them of their digital assets. As cryptocurrency transactions are irreversible, stolen funds are permanently lost to victims.

Attend a Free Webinar on How to Maximize Cybersecurity Program ROI

If users screenshot their recovery phrase and have it stolen by SpyAgent, attackers need only recover the wallet and transfer funds to the destination of their choice.

According to Coin Telegraph, the malware has been making the rounds in South Korea, with more than 280 APKs affected, which is distributed outside the official Google Play store, often using SMS messages or social media posts to capture user interest. 

Some infected apps mimic South Korean or UK government services, while others appear to be dating or adult content applications.

There are also indications that attackers may be preparing to expand into the United Kingdom, which could lead to more widespread compromise. 

While the malware is currently Android-only, there are signs that an iOS version may be in development.

OCR technology, commonly used for cryptocurrency recovery phrase theft, can pose significant risks to businesses and individuals. 

Malicious actors can easily steal screenshots containing sensitive information like login credentials, personal data, or confidential contacts, leading to data breaches, identity theft, and unauthorized access to sensitive systems.

Even devices with strong security measures like MFA and SSO are vulnerable if users store sensitive information in screenshots, as these can be compromised through infected applications.

Stolen screenshots used to compromise mobile devices pose a significant security risk. Attackers can exploit these images to gain unauthorized access to critical services, lock out legitimate users, and exfiltrate sensitive data from various IT systems. 

The delayed detection of such attacks, often exceeding 258 days, allows attackers ample time to execute their malicious activities, which underscores the need for robust security measures, including advanced threat detection and response capabilities, to mitigate the potential impact of such attacks.

According to IBM, cybersecurity threats are prevalent on mobile devices, as sensitive data such as crypto recovery passwords, corporate logins, and personal information should not be stored on devices. 

Users should avoid unsolicited texts and download apps only from official app stores. To minimize risks, users should limit device data storage and prioritize using the official Google Play Store for app downloads. 

Run private, Real-time Malware Analysis in both Windows & Linux VMs. Get a 14-day free trial with ANY.RUN!

Aman Mishra
Aman Mishra
Aman Mishra is a Security and privacy Reporter covering various data breach, cyber crime, malware, & vulnerability.

Latest articles

Three New ICS Advisories Released by CISA Detailing Vulnerabilities & Mitigations

The Cybersecurity and Infrastructure Security Agency (CISA) announced three new Industrial Control Systems (ICS)...

Security Researchers Discover Critical RCE Vulnerability, Earn $40,000 Bounty

Cybersecurity researchers Abdullah Nawaf and Orwa Atyat, successfully escalated a limited path traversal vulnerability...

IBM i Access Client Solutions Might Be Leaking Your Passwords

A potential security flaw in IBM i Access Client Solutions (ACS) has raised serious...

Weaponized VS Code Impersonate Zoom App Steals Cookies From Chrome

A newly identified extension for Visual Studio Code (VS Code) has been found to...

API Security Webinar

Free Webinar - DevSecOps Hacks

By embedding security into your CI/CD workflows, you can shift left, streamline your DevSecOps processes, and release secure applications faster—all while saving time and resources.

In this webinar, join Phani Deepak Akella ( VP of Marketing ) and Karthik Krishnamoorthy (CTO), Indusface as they explores best practices for integrating application security into your CI/CD workflows using tools like Jenkins and Jira.

Discussion points

Automate security scans as part of the CI/CD pipeline.
Get real-time, actionable insights into vulnerabilities.
Prioritize and track fixes directly in Jira, enhancing collaboration.
Reduce risks and costs by addressing vulnerabilities pre-production.

More like this

Three New ICS Advisories Released by CISA Detailing Vulnerabilities & Mitigations

The Cybersecurity and Infrastructure Security Agency (CISA) announced three new Industrial Control Systems (ICS)...

Security Researchers Discover Critical RCE Vulnerability, Earn $40,000 Bounty

Cybersecurity researchers Abdullah Nawaf and Orwa Atyat, successfully escalated a limited path traversal vulnerability...

IBM i Access Client Solutions Might Be Leaking Your Passwords

A potential security flaw in IBM i Access Client Solutions (ACS) has raised serious...