Newly discovered PhoneSpy Spyware Already Infected Over 1000 Phones

More than 1,000 Android devices have been infected with the new PhoneSpy spyware, which secretly records audio and video in real time, steals files and performs many other spyware actions, according to Zimperium. The malware is primarily targeted at South Korean users.

In total, the researchers found 23 apps that secretly installed spyware on usersdevices. Among them were Yoga companion app, Kakao Talk messenger, image gallery browser, photo editing tool and more.

During installation, such applications ask the victim to grant numerous permissions, but this is the only thing that can raise suspicion from the userotherwise, PhoneSpy behaves stealthily.

Malware asks for permissions
Malware asks for permissions

Zimperium experts did not find any evidence that infected applications are available on Google Play or other app stores. Therefore, they suspect PhoneSpy is spreading through traffic redirection or social engineering.

Infected applications
Infected applications

The spyware built into such applications and offers a wide range of features and spy functions. In essence, PhoneSpy works like a Remote Access Trojan (RAT) that receives and executes commands from its operators to collect and steal data and more. Така, PhoneSpy can:

  1. collect a complete list of installed applications;
  2. steal credentials using phishing (the malware has templates for Facebook, Instagram, Kakao, and Google);
  3. steal images;
  4. track locations via GPS;
  5. steal SMS messages;
  6. steal phone contacts;
  7. steal call logs;
  8. record audio in real time;
  9. record video in real time using the front and rear cameras of the device;
  10. access the camera to take photos with the front and rear cameras;
  11. send SMS to a phone number controlled by the attacker with a text controlled by the attacker;
  12. retrieve information about the device (IMEI, brand, device name, Android version);
  13. hide your presence in the system by hiding your icon.
Така, after infection, the user’s mobile device will transmit accurate GPS location data to hackers, and will also upload photos and messages to the control server, contact lists and downloaded documents. The researchers say the data stolen from the devices could be used, например, for personal and corporate blackmail and espionage.

Let me remind you that we also wrote that Windows exploits and DevilsEye spyware are associated with the Israeli company Candiru.

Хелга Смит

Винаги съм се интересувал от компютърни науки, особено сигурността на данните и темата, което се нарича в наши дни "наука за данни", от ранните ми тийнейджърски години. Преди да дойде в екипа за премахване на вируси като главен редактор, Работил съм като експерт по киберсигурност в няколко компании, включително един от изпълнителите на Amazon. Друг опит: Преподавам в университетите Арден и Рединг.

Оставете коментар

Този сайт използва Akismet за намаляване на спама. Научете как се обработват вашите коментарни данни.

Бутон за връщане в началото