Monday, December 4, 2023

New ViceLeaker Malware Attack on Android Devices With Backdoor Capabilities to Hijack Camera, Record Audio

Researchers discovered a new malware campaign called ViceLeaker that specifically targeting the Android users with sophisticated backdoor capabilities to Hijack camera, delete files, record audio and more.

Some of the Malware samples discovered by Kaspersky researchers are modified versions of an open source Jabber/XMPP client called “Conversations”  a legitimate version of the Android app available in Google Play.

Threat actors using Smali injection technique to backdoor legitimate applications and this technique more often used by attackers to disassemble the code of the original legitimate app with the help of Baksmali tool, Once they have added the malicious code then they assemble it with Smali.

During the APK analysis phase, researchers uncovered that the malware employed some of the common spyware features and in additional, it capable of upload, download, delete files, take over the camera and record surrounding audio.

Modified Version of Conversations Samples

Newly discovered samples that are modified version of conversations app and the app sharing code with ViceLeaker malware with similar characters.

 According to Kaspersky research, The Conversations modified samples differ from the original one in the getKnownHosts method that was modified to replace the main XMPP host with the attackers’ C2 server.

There are many modifications was applied with the app and the attackers were using a specific C2 for the use of that app.

The malware uses HTTP for communication with the C2 server for command handling and data exfiltration.

In addition, attackers also changed the icon and package name that mimics Telegram messenger to adding the code and it might be one of the way attackers to hide their origin, researchers believe.

Even though, its a backdoor version of Conversations app, there wasn’t any malicious activities uncovered. but this modified version might be used by threat actors for their internal communication.

Attackers using “185.51.201[.]133” as a main C2 address for a backdoored version of Conversations app.

Researcher name this operation as “ViceLeaker”, because of strings and variables in its code.

“The operation of ViceLeaker is still ongoing, as is our research. The attackers have taken down their communication channels and are probably looking for ways to assemble their tools in a different manner, Kaspersky said.”

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Also Read

Chinese APT 10 Group Hacked Nearly 10 Telecom Networks and Stealing Users Call Records, PII, Credentials, Email Data and more

Hackers Take Complete Control of Your Android Device by Launching MobOk Malware via Fake Photo Editing Apps in Google Play


Latest articles

Hackers Use Weaponized Documents to Attack U.S. Aerospace Industry

An American aerospace company has been the target of a commercial cyberespionage campaign dubbed...

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles