Several Malicious Apps on Google Play Posing as Voice Messenger Steal User Personal Information

Malicious apps on Google play posing as a legitimate voice messenger pop-ups fake survey forms in user’s devices and generate fraudulent ad clicks.

Security researchers from TrendMicro observed a number of malicious apps and they have deployed one by one since October and the cybercriminals continue to add more features to those apps.

Once such voice messenger app that contains common behaviors analyzed by researchers, all the identified apps having the same codes, behavior and they are from the same developer.

Malicious Apps Steal User Information

Once these malicious apps downloaded to the user’s device, then it establishes a connection with the C&C server then decrypts and execute the payload.

The payload executes two modules, Icon which hides icon and reduces the chance for the user in removing the app and the next one Wpp that open’s browser to access arbitrary URLs and generates fraudulent ad clicks.

The app displays the fake popups and gathers user’s personal information such as names, phone numbers, and home addresses, in exchange for gift cards.

The app use to open the face survey form in default browser, if default browser not preferred then the app will open survey form in any one of the browsers that include Boat Browser, Brave, Chrome, Cheetah, Dolphin, DU, Firefox, Jiubang Digital Portal, Link Bubble, Opera, Opera Mini, Puffin, and UC.

We have not observed communication with the server, we believe that this feature is still in development, researchers said.

All the identified apps have been reported to Google by Trend Micro and the malicious apps are removed now.

Recently a massive ad fraud scheme uncovered that tracked users when they are downloaded new apps and use their to claim the credit, this process called as click flooding and click injection.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…

24 hours ago

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…

3 days ago

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…

3 days ago

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…

3 days ago

Google Chrome Security, Critical Vulnerabilities Patched

Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…

3 days ago

Notorious WrnRAT Delivered Mimic As Gambling Games

WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…

4 days ago