Thursday, March 28, 2024

Newly Discovered “System Update” Android Malware Steals Photos, Videos & GPS Location

We should always stay alert and cautious with the applications that we download and install from outside the Play Store since we can download an app with malware that could infect our Android devices.

As recently, the cybersecurity researchers at Zimperium have discovered a malicious app that can be downloaded outside of Google Play (third-party Android app stores). 

Once the user downloads this malicious app on their smartphone, the app contacts the Firebase server and starts controlling the device remotely. Moreover, the security experts have affirmed that this malicious app screen itself as “System Update.”

New Malware: “System Update”

This new “System Update” malware is surprisingly sophisticated malware, and this malware tricks and infects the users by launching a notification that pretends to be a system update.

In this situation, when the user clicks on the notification, the malware asks the user to install this new application, which will later request full access to the device. 

And here once the user grants the access, it will simply take over the control of the device and will get access to all the following things that we have mentioned below:-

  • Messages in messenger apps.
  • If you have root rights, then it will also have access to the messenger database files.
  • Bookmarks.
  • Browsing history.
  • Search history in Chrome, Mozilla Firefox and Samsung browser.
  • Several types of files like .pdf, .doc, .docx, and .xls, .xlsx.
  • Clipboard data.
  • Content of the notifications.
  • List of installed apps.
  • Images and Videos.
  • GPS location data.
  • SMS messages.
  • Contacts.
  • Call logs.
  • Recording audio.
  • Recording phone calls.
  • Installed apps. 
  • Device name.
  • Storage statistics.
  • Camera.

How Does It Work?

According to the report, the malware sends various data to its Firebase C&C server just after getting installed on the device. And the data that it sends includes storage stats, ISP details, and installed apps. 

However, here the Firebase is used only for conveying commands, while a separate C&C server is used to collect other stolen data using POST requests. This malware collects data directly if it has root access or uses the “Accessibility Services” function on the compromised device.

Moreover, to hide its malicious activities, it publicised fake notifications about the search for updates when it receives new commands from its speculators.

But, here, the most relaxing thing is that this malicious app has never been available on Google Play, and not only that, even the developers at Google are trying their best to prevent it from circumventing its security walls.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity, and hacking news updates.

Website

Latest articles

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles