Subscription Trojan Downloaded 600K Times From Google Play

Security scientists have uncovered a new piece of Trojan malware put in on a lot more than 620,000 devices, after remaining concealed in 11 Android apps detailed on Google Perform.

Dubbed “Fleckpe” by Kaspersky, the malware is comparable to the Jocker and Harly strains and has been energetic considering that 2022.

It is designed to covertly subscribe the sufferer to top quality expert services, generating revenue for its operator although the consumer is fully unaware.

Examine much more on cellular Trojan malware: Researchers Learn Almost 200,000 New Mobile Banking Trojan Installers.

Fleckpe was concealed in a handful of image enhancing applications, smartphone wallpaper packs and other titles, even though the malicious marketing campaign could be even much more comprehensive than that so much identified, Kaspersky warned.

When the app begins, it loads a greatly obfuscated native library that contains a destructive dropper that decrypts and runs a payload from the app property. This payload contacts the malicious actor’s command and regulate (C2) server, sending product data back and acquiring a paid membership web page in return.

The Trojan then opens an invisible web browser and attempts to subscribe on the user’s behalf, pulling a affirmation code if demanded from notifications.

All the whilst, the victim is equipped to use the app’s legitimate-wanting operation, unaware they’ve been subscribed to a compensated services costing them funds.

“The Trojan keeps evolving. In recent versions, its creators upgraded the native library by shifting most of the membership code there. The payload now only intercepts notifications and views web internet pages, performing as a bridge between the native code and the Android factors necessary for buying a membership,” Kaspersky discussed.

“This was done to appreciably complicate assessment and make the malware tough to detect with the security applications. Unlike the indigenous library, the payload has next to no evasion abilities, whilst the destructive actors did incorporate some code obfuscation to the hottest version.”

Membership Trojans like this are an increasingly popular way for risk actors to make revenue, and however they usually stop up on the official Play keep.

“The rising complexity of the Trojans has permitted them to effectively bypass many anti-malware checks implemented by the marketplaces, remaining undetected for prolonged durations of time,” Kaspersky warned. “Affected users usually are unsuccessful to learn the unwanted subscriptions suitable away, let by yourself come across out how they took place in the to start with place.”

Editorial image credit rating: I AM NIKOM / Shutterstock.com

Some pieces of this write-up are sourced from:
www.infosecurity-magazine.com