Saturday, July 13, 2024

100M+ Downloaded Shein App Found Copying Clipboard Content on Android Phones

There have been recent revelations by Microsoft that an old version of the SHEIN Android application has been found reading the contents of the clipboard on Android devices irregularly.

With more than 100 million downloads from the Google Play Store, SHEIN’s Android app is one of the most popular in the marketplace. This Singapore-based retailer has been an online fast fashion retailer for over a decade, originally operating under the name ZZKKO.

It should be possible to send the contents of the clipboard to a remote server if a particular pattern can be identified. Despite this, Microsoft hasn’t identified any malicious intent behind the behavior and is not aware of any such activities.

It is important to understand the risks that the installed applications can pose even if SHEIN didn’t have malicious intent. As an example, this can include the popular apps that are loaded from the official app store of the platform since they are highly popular.

The Android Security Team at Google was tasked with investigating after Microsoft reported its findings to Google, which operates the Play Store.

Shein App Found Copying Clipboard Content

There have been no updates to the app since the release of version 7.9.2 on December 16, 2021. Microsoft researchers reported that on March 6 they discovered this issue that has been fixed in the May 2022 update.

In order to prevent possible malicious attacks, users must make sure their installed application is up-to-date. Since mobile users frequently use clipboards to copy and paste sensitive information, clipboards are an appealing target for cyberattacks. 

While in the clipboard users mainly perform the copy and paste of the following type of data:-

  • Login credentials
  • Financial data
  • Personal information

In order to identify and observe the code responsible for the particular behavior of the application, Microsoft’s cybersecurity analysts performed two types of analysis, and here they are mentioned below:-

  • Static analysis
  • Dynamic analysis

By exploiting this clipboard vulnerability threat actors can easily modify the contents of the clipboard for several types of other malicious activities. The application triggers a POST request to the server “api-service[.]shein[.]com.” when any content copied to the clipboard is launched.

In the past few years, Google has taken steps to mitigate the privacy risks involved with Android in order to make it more secure.


Here below we have mentioned all the recommendations offered by the cybersecurity analysts at Microsoft:-

  • Make sure that the device as well as the installed applications are always kept up-to-date.
  • Installing an application from a source you are not familiar with is never a good idea.
  • If an application is showing unexpected behavior, you should consider removing it.
  • Always make sure to use a robust antivirus system on your device.

Network Security Checklist – Download Free E-Book


Latest articles

mSpy Data Breach: Millions of Customers’ Data Exposed

mSpy, a widely used phone spyware application, has suffered a significant data breach, exposing...

Advance Auto Parts Cyber Attack: Over 2 Million Users Data Exposed

RALEIGH, NC—Advance Stores Company, Incorporated, a prominent commercial entity in the automotive industry, has...

Hackers Using ClickFix Social Engineering Tactics to Deploy Malware

Cybersecurity researchers at McAfee Labs have uncovered a sophisticated new method of malware delivery,...

Coyote Banking Trojan Attacking Windows Users To Steal Login Details

Hackers use Banking Trojans to steal sensitive financial information. These Trojans can also intercept...

Hackers Created 700+ Fake Domains to Sell Olympic Games Tickets

As the world eagerly anticipates the Olympic Games Paris 2024, a cybersecurity threat has...

Japanese Space Agency Spotted zero-day via Microsoft 365 Services

The Japan Aerospace Exploration Agency (JAXA) has revealed details of a cybersecurity incident that...

Top 10 Active Directory Management Tools – 2024

Active Directory Management Tools are essential for IT administrators to manage and secure Active...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles