Open source spyware reaches Google Play Store

ESET researchers have discovered the first known cases of spyware based on an open source spyware tool called AhMyth.

This special spyware is an Internet radio application that broadcasts very specific music in Balochi. However, spy functions can be easily linked to any other application.

(AhMyth) – who borrowed his harmful duties via radio applications – to the public at the end of 2017.

Since then, various malicious applications based on AhMyth have emerged. However, the aforementioned application, called Radio Balouch, is the first of its kind to enter the official Google Play Android app store.

ESET Mobile Security for Android protects users of AhMyth and its derivatives since January 2017, before AhMyth is made public.

Lucas Estefanko, an ESET malware researcher who conducted the investigation, said: The malicious function of AhMyth is not hidden, protected or ambiguous. For this reason, it is easy to identify Radio Balouch – and other derivatives – as malicious and to classify it as belonging to. For the family (AhMyth).

After ESET reported the discovery to Google, its security team removed the harmful Radio Balouch app from the store, although the attackers were quick to make it reappear on Google Play.

"As we discovered and reported the second instance of this malware, which was quickly removed, the concern remains that the developer himself could frequently deploy this obvious malware in the store," he said. he declares.

Balouch Radio is now available in alternative app stores after removing it from Google Play, which allows you to spy on Users must steal contacts and collect files stored in the device.

He warned that the open source spyware tool (AhMyth) included a number of variables whose functions were different.

According to ESET researchers, the repeated emergence of malicious application (Radio Balouch) in the Google Play Store should be a warning to the Google security team and users of 39; Android.

"Unless Google improves its preventative capabilities, new versions of Radio Balouch or any other derivative of AhMyth may appear on Google Play," Lucas Estefanco says.

"There is still a fundamental safety imperative to respect the sources of official applications.We strongly recommend users to check every application that they intend to install on their devices and d & rsquo; To use reputable mobile security solutions. "