Sextortionists Deploy New Spyware

New adware has been detected that targets iOS and Android buyers who patronize illicit websites that ordinarily offer escort solutions. 

The malware, named Goontact by the Lookout researchers who found out it, targets heterosexual people in China, Korea, Japan, Thailand, and Vietnam, thieving personal details from their mobile devices. 

Researchers pointed out: “The forms of websites employed to distribute these malicious apps and the information and facts exfiltrated indicates that the top purpose is extortion or blackmail.”

Goontact usually disguises alone as secure messaging applications. The malware has been noticed exfiltrating a wide vary of facts, which include machine identifiers and phone number, contacts, SMS messages, location info, and pics on external storage.

Describing how buyers fall target to the spy ware, scientists wrote: “The scam commences when a prospective focus on is lured to a single of the hosted web pages the place they are invited to join with girls. 

“Account IDs for safe messaging apps such as KakaoTalk or Telegram are advertised on these web pages as the ideal types of conversation and the unique initiates a discussion. In truth, the targets are communicating with Goontact operators.”

By pretending that they are dealing with audio or video clip difficulties, the operators persuade their targets to put in or sideload a mobile software that has no serious consumer performance over and above stealing the victim’s handle ebook.

Scientists feel that the danger marketing campaign is staying operated by “a criminal offense affiliate” because websites related with the spyware are very similar in look, naming convention, and focused geographic area. 

The sites use logos affiliated with domains caught up in a former sextortion marketing campaign uncovered in 2015 by Development Micro. 

Goontact appears to be a the latest addition to a campaign that has been active since at minimum 2013. 

“The earliest sample of Goontact observed by Lookout was in November 2018, with matching APK packaging and signing dates, foremost us to imagine malware advancement probable began in this time body,” wrote scientists. 

The enterprise mobile provisioning profiles used by Goontact all reference apparently respectable organizations, together with Linkplay Tech Inc and Jinhua Changfeng Info Technology Co.

Researchers explained that it was unclear regardless of whether these signing identities have been compromised, or if they had been designed by malware operators spoofing representatives of the corporations.

Some pieces of this report are sourced from:
www.infosecurity-magazine.com