Sextortionist Campaign Targets iOS, Android Users with New Spyware

New adware is concentrating on iOS and Android frequenters of adult mobile sites by posing as a safe messaging software in nonetheless one more twist on sextortionist ripoffs.

The spy ware, dubbed Goontact, targets people of escort-company web pages and other sex-oriented companies – notably in Chinese-speaking countries, Korea and Japan, according to analysis printed by Lookout Menace Intelligence on Wednesday.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The ploy and malware can in the end be used to exfiltrate information from targets. Knowledge siphoned from products include phone range, make contact with listing, SMS messages, shots and spot information and facts. The character of the facts sweep and the context of the attacks “suggests that the best objective is extortion or blackmail,” scientists Robert Nickle, Apurva Kumar and Justin Albrecht observed in a report revealed on line Wednesday.

Sextortionist frauds, in which danger actors declare they have movie or other information and facts that back links a potential victim to illicit exercise that could threaten a marriage, task or other sizeable relationship or fascination, are very little new. Nonetheless, attackers generally use email to supply these type of cons, making use of a range of practices to get earlier email defenses and trick victims.

The new marketing campaign utilizes a distinctive and evolving tack. It lures a prospective concentrate on by inviting them by way of an advert on a hosted illicit web site to connect with girls for no cost by applying KakaoTalk or Telegram protected messaging applications. If an individual requires the bait and initiates a dialogue, it is Goontact operators with whom the particular person makes make contact with, researchers stated.

“Targets are convinced to put in (or sideload) a mobile software on some pretext, these as audio or video issues,” they wrote. “The mobile programs in concern seems to have no genuine user features, except to steal the victim’s address e-book, which is then used by the attacker finally to extort the goal for financial get.”

The particulars of the attack are different depending on if a target is using an iOS or Android device. The iOS attacks have much less ability to steal knowledge, lifting only the victim’s phone range and contact record, scientists mentioned. In some afterwards iterations of the adware, it connects to a secondary command-and-regulate (C2) server and shows a concept customized to the person right before exiting the application.

The Android-centered attack has substantially extra risk functionality, researchers explained. “In addition to speak to thieving, these samples consist of additional highly developed operation such as exfiltration of SMS messages, shots and site,” scientists wrote.

The Lookout staff thinks that the facts stolen in the campaign will be applied to blackmail or defraud victims, although so considerably they stated they have seen no evidence proving this circumstance.

The campaign alone bears resemblance to one reported by scientists in 2015, and Lookout scientists suspect it is been close to and operated by a criminal offense affiliate instead than nation-point out actors considering the fact that 2013.

“However, the Goontact malware loved ones is novel and is however actively remaining created,” with the earliest sample acquiring been noticed in November 2018, scientists stated.

Lookout scientists have contacted Google and Apple about Goontact as perfectly as educated Threat Advisory Products and services prospects with additional intelligence on the spyware and other threats.

Put Ransomware on the Operate: Save your place for “What’s Up coming for Ransomware,” a FREE Threatpost webinar on Dec. 16 at 2 p.m. ET. Find out what is coming in the ransomware entire world and how to battle back. 

Get the hottest from John (Austin) Merritt, Cyber Risk Intelligence Analyst at Electronic Shadows Limor Kessem, Govt Security Advisor, IBM Security and Allie Mellen, a security strategist in the Business office of the CSO at Cybereason, on new sorts of attacks. Subjects will incorporate the most harmful ransomware danger actors, their evolving TTPs and what your business desires to do to get in advance of the upcoming, inevitable ransomware attack. Sign up here for the Wed., Dec. 16 for this LIVE webinar.