![]() ![]() "In an enterprise environment, versioning demonstrates a need for defense-in-depth principles, including but not limited to limiting application installation sources to trusted sources such as Google Play or managing corporate devices via a mobile device management (MDM) platform," the company said. SharkBot is a financial trojan that initiates unauthorized money transfers from compromised devices using the Automated Transfer Service (ATS) protocol.ĭropper applications that appear on the storefront come with reduced functionality that, once installed by the victims, download a full version of the malware in a bid to attract less attention. This is achieved by pushing an update from an attacker-controlled server to serve malicious code on the end user device using a method called dynamic code loading (DCL), effectively turning the app into a backdoor.Įarlier this May, ESET discovered a screen recording app named "iRecorder - Screen Recorder" that remained innocuous for nearly a year after it was first uploaded to the Play Store before malicious changes were introduced to covertly spy on its users.Īnother example of malware using the DCL method is SharkBot, which has repeatedly made an appearance on the Play Store by masquerading as security and utility apps. In this method, a developer releases an initial version of an app on the Play Store that passes Google's pre-publication checks, but is later updated with a malware component. ![]() ![]() While versioning is not a new phenomenon, it's sneaky and hard to detect. "Campaigns using versioning commonly target users' credentials, data, and finances," Google Cybersecurity Action Team (GCAT) s aid in its August 2023 Threat Horizons Report shared with The Hacker News. Threat actors are leveraging a technique called versioning to evade Google Play Store's malware detections and target Android users. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |