“Spide”: Android Malware from Play-Store Blackmail victims

IT security researchers have discovered malware from Google Play Store that falls into thousands of installations. It is about financial crime, blackmailing the victims with sensitive data which is on their Android smartphone.

Advertisement

In an analysis, IT researchers of Cyfirma remove malware. This provider is available from Com.Someca.count in the Play Store of Google under the name “Finance Simplified”. Other harmful apps com.KredidaplePronw.com, “Kreditaplle.apk” by com.Poklaan.frein and “Stohshfur.apk” by com.Stohlfurpro.com tolerate “kreditaplle.apk” by com.Poklaan.frein and “Stohshfur.apk”. According to Cyfirma, the deadly “Finance simplified” app was available in the Play Store shortly before the weekend. Now, however, Google shows 404 error messages when trying to call the concerned party.

Partial warning: sacrifice wanted in India

Criminals are currently searching for victims in India. Apps should make “hunter credit request”. Based on localization, Indian potential customers are informed of authorized credit apps that run within the webwules components, weakening the protective mechanisms of the attackers Play Store. After installation, malware apps collect sensitive user data, try to express you exploitative loans and implement efforts to blackmail them.

The campaign impedes the confidence of parties interested in financial equipment and app stores. However, it also shows IT researchers to avoid the advanced methods of criminals and serve significant damage.

Apple Commission on Web Purchase: Despite internal concerns

The malware app was probably still available in the Google Play Store until the weekend. It came between 50,000 and 100,000 establishments within just one week, discussed Cyphirma. User comments, based on the photos of the smartphone, had several complaints about forced recovery efforts and misuse of personal information – including the creation of false nude pictures. Command-end-control servers run on the EC2 cloud system of Amazon. Since the administrator panels provide English and Chinese, Cyfirma also shuts down Chinese speaking attackers. Interested parties get a very detailed insight into the apps of the apps Detailed Cyfirma Analysis,

In addition to APK names and manufacturers in the Play Store, Cyfirma analysis provides further information for an infection (indicator of compromise, IOCs). Command-end-control server domain names or haveh of malware. For IT managers, the authors also provided the Yara rules.

Repeated criminals manage the smuggling of previous malware of the safety mechanisms of the app store of smartphones platforms. On the other hand, the platform operators move frequently. Google threw about 2.4 million apps from Play Store in 2024.

(DMK)