Monday, March 4, 2024

Google Discovered New Tizi Android Spyware that can Spying WhatsApp, Viber, Skype, LinkedIn

A highly critical Tizi Android Spyware discovered from Google Play store that have rooting capabilities to spying the sensitive information in Android mobile users popular social media applications.

Tizi steals sensitive data from popular social media apps like Facebook, Twitter, WhatsApp, Viber, Skype, LinkedIn, and Telegram.

Also Read:  Facebook Image Removal Vulnerability allows Users to Delete any Photos

This spyware app Developers creating a website for promoting the spyware via social media to reach more number of peoples and trick them to install this Malicious spyware app.

Tizi-infected app

It mainly targeting  African countries, specifically: Kenya, Nigeria, and Tanzania . kenya is listed as most impact country by this  Tizi Android Spyware.but there was also a significant number of infections in Nigeria and Tanzania.

This malicious application discovered by google security scan and it mainly performing to gain the root access of the target and exploit the old vulnerabilities.

According to the Google report, around 1,300 devices affected by Tizi and still its rapidly spreading its variant around the world.

How Does Tizi Android Spyware Work?

Since earlier Tizi family variants didn’t have the rooting and obfuscation capabilities, newly spreading this Tizi gain root access of targeting phone is considering as a main future.

Once it gaining the root access of the targeting mobile , it will contact first to the command & control server by sending the SMS with the device’s GPS coordinates.

Communication between C&C Server and Tizi using HTTPS in some specific versions,Tizi uses the MQTT messaging protocol with a custom server.

After established the successful connection, Tiza backdoor performing some dangerous spying activities  such as  recording calls from WhatsApp, Viber, and Skype; sending and receiving SMS messages; and accessing calendar events, call log, contacts, photos, Wi-Fi encryption keys, and a list of all installed apps. 

According to Google, Tizi apps can also record ambient audio and take pictures without displaying the image on the device’s screen.

Tizi Android Spyware Exploiting related vulnerabilities are mainly  target older chipsets, devices, and Android versions.

But most of the vulnerabilities are already patched but Tizi Android Spyware always trying to gain some high level permission by sending SMS messages and monitoring, redirecting, and preventing outgoing phone calls.

Tizi Android Spyware can root the device by exploiting one of the following local vulnerabilities:
  • CVE-2012-4220
  • CVE-2013-2596
  • CVE-2013-2597
  • CVE-2013-2595
  • CVE-2013-2094
  • CVE-2013-6282
  • CVE-2014-3153
  • CVE-2015-3636
  • CVE-2015-1805

Mitigation Steps for  PHA’s

Potentially Harmful Applications are always try to install some harmful malicious application into victims mobile. following steps are common mitigation step to protecting from PHA’s by Google.

  • Check permissions: Be cautious with apps that request unreasonable permissions. For example, a flashlight app shouldn’t need access to send SMS messages.
  • Enable a secure lock screen: Pick a PIN, pattern, or password that is easy for you to remember and hard for others to guess.
  • Update your device: Keep your device up-to-date with the latest security patches. Tizi exploited older and publicly known security vulnerabilities, so devices that have up-to-date security patches are less exposed to this kind of attack.
  • Google Play Protect: Ensure Google Play Protect is enabled.
  • Locate your device: Practice finding your device, because you are far more likely to lose your device than install a PHA.

Latest articles

New Silver SAML Attack Let Attackers Forge Any SAML Response To Entra ID

SolarWinds cyberattack was one of the largest attacks of the century in which attackers...

AI Worm Developed by Researchers Spreads Automatically Between AI Agents

Researchers have developed what they claim to be one of the first generative AI...

20 Million+ Cutout.Pro User Records Leaked On Hacking Forums

CutOut.Pro, an AI-powered photo and video editing platform, has reportedly suffered a data breach,...

CWE Version 4.14 Released: What’s New!

The Common Weakness Enumeration (CWE) project, a cornerstone in the cybersecurity landscape, has unveiled...

RisePro Stealer Attacks Windows Users Steals Sensitive Data

A new wave of cyber threats has emerged as the RisePro information stealer targets...

Golden Corral Restaurant Chain Hacked: 180,000+ Users’ Data Stolen

The Golden Corral Corporation, a popular American restaurant chain, has suffered a significant data...

CISA Warns Of Hackers Exploiting Multiple Flaws In Ivanti VPN

Threat actors target and abuse VPN flaws because VPNs are often used to secure...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles