Brazil is one of the leading countries with users affected by malicious apps on the Google Play Store

<img width = "696" height = "377" clbad = "entry-thumb td-modal-image" src = "https://www.criptomoedasfacil.com/wp-content/uploads/2019/01/ brazil3_1148107-4-696×377.jpg "srcset =" https://www.criptomoedasfacil.com/wp-content/uploads/2019/01/brazil3_1148107-4-696×377.jpg 696w, https://www.criptomoedasfacil.com/ wp-content / uploads / 2019/01 / brazil3_1148107-4-150×81.jpg 150w, https://www.criptomoedasfacil.com/wp-content/uploads/2019/01/brazil3_1148107-4-300×162.jpg 300w, https: //www.criptomoedasfacil.com/wp-content/uploads/2019/01/brazil3_1148107-4.jpg 700w "sizes =" (max-width: 696px) 100vw, 696px "alt =" Brazil is one of the main countries with users affected by malicious applications in the Google Play Store "title =" Brazil is one of the first countries with users affected by malicious applications in the Google Play Store "pagespeed_url_hash =" 355453078 "onload =" pagespeed Trend Micro, one of the global giants of cybersecurity , recently discovered a spyware, spyware, to observe and steal the personal information of users (detected under the name ANDROIDOS_MOBSTSPY) – who disguised themselves as legitimate Android applications – applications were available for download on the Google Play Store in 2018, some having already been downloaded more than 100,000 times by users worldwide.

Last year, BleepingComputer reported that several malware was being installed on Android-based mobile phones and criptomoe mining. among them, especially Monero, in the background, while users thought they were performing the normal tasks that the application promised them. Malicious exploitation has been carried out in various applications, including those intended for everyday features such as task and game organizers.

In this case revealed by Trend Micro, it is not a malicious extraction, but a phishing for information theft. It can also affect wallet services installed on the mobile phone and even exchange accounts that do not have a robust security feature. Part of what makes this case interesting lies in the breadth of the distribution of your applications. Through Trend Micro's in-depth and in-depth badysis, distribution in different countries, with relevant users from 196 different countries, has been verified. One of the applications initially studied was the game Flappy Birr Dog. [1] One of the applications initially studied was the game Flappy Birr Dog. Other apps include FlashLight, HZPermis Pro Arabic, Win7imulator, Win7Launcher and Flappy Bird. Google has already removed all these apps from your Google Play store.

"MobSTSPY" is able to steal information such as the location of the user, SMS conversations, call logs and clipboard items. Once the malicious application is started, the malicious software first checks the availability of the device network. It then reads and badyzes an XML configuration file from your C & C server.

Malware will then collect certain device information, such as the language used, the registered country, the package name, the manufacturer of the device peripheral, etc. Depending on the command received by malicious software, it can steal SMS conversations, contact lists, files and call logs. The malware is also able to steal and download files found on the device.

Felippe Batista, Trend Micro cloud information security specialist, warns users to be cautious when downloading, "The popularity of apps is driving cybercriminals to continue to develop malware to steal information." or to perform other types of attacks.In addition, users can install a complete cybersecurity solution to protect their mobile devices against mobile malware. "

In addition to its features From theft of information, malware can also collect additional credentials through a phishing attack. It is able to display fake pop-up windows of services such as Facebook, Google, among others for phishing the details of the user account (login, pbadword, among others). If the user enters his or her credentials, the fake pop-up window will only indicate that the connection has failed, thus allowing hackers to access the accounts of all users with the information of the user. identification obtained and to steal their funds in cryptocuments and (s), [][] () () () () () () () () () () (); js.id = id; js.src = "http://connect.facebook.net/en_US/sdk.js#xfbml=1&version=v2.9&appId=1824205124464728"; fjs.parentNode.insertBefore (js, fjs); } (document, 'script', 'facebook-jssdk')); [ad_2]
Source link