Last week in security news, researchers spotted 15 adware-laden Android apps lurking on the Google Play store that hid their icons after users installed them. Analysts also detected several phishing campaigns, including one that used certified email to deliver malware. Finally, news emerged of a city in Georgia that avoided data loss after suffering its third ransomware attack this year.

Top Story of the Week: Sneaky Android Adware on the Google Play Store

Security researchers at SophosLabs discovered 15 apps that had a combined total of 1.3 million downloads from Android users. After successful installation, each of these apps displayed a fake error message and redirected users to Google Maps to trick them into thinking there was a problem with installation. The app then hid its own icon to establish persistence on the infected device so it could begin aggressively serving up ads.

SophosLabs notified Google about these malicious programs back in July 2019. According to the security firm’s research, Google’s teams responded by removing the apps from Google Play.

Source: iStock

Also in Security News

• Digi Phishing Campaign Offers a Fake Prize to Users: Heimdal Security detected a phishing campaign that impersonated the Digi brand and informed users that they were eligible to receive a smartphone gift. The campaign then redirected users to additional pages designed to steal their credit card details along with information about their devices and web connection.
• sLoad Malware Operation Abuses Certified Email to Target Italian Users: In a campaign observed by Cybaze-Yoroi ZLAB, Italian organizations and consultants received certified emails that attempted to trick users into opening a ZIP archive. When opened, the attachment launched a VBS script that ran additional scripts and ultimately installed the final sLoad payload.
• Security Incidents Not Reported by Two-Thirds of Industrial Organizations: Sixty-seven percent of industrial organizations told Kaspersky Lab that they don’t report digital security incidents to regulators. Notwithstanding that finding, more than half (55 percent) of respondents said that regulatory compliance demands constituted the top driver for strategizing their security investments.
• FIN6 Preyed on Thousands of Online Shops Using Magecart Attack: Trend Micro discovered an online payment card skimming attack that began on Sept. 7, 2019 and affected approximately 3,126 online shops within the span of a month. Following a deep analysis, Trend Micro attributed the campaign to Magecart Group 6 (also known as FIN6).
• Close to a Million Android Devices Enslaved by Geost Botnet Since 2016: An international group of researchers uncovered a new botnet called Geost that compromised legitimate apps available for download on the Google Play store using malicious code. This technique enabled the threat, which leveraged 13 command-and-control (C&C) servers and hundreds of domains at the time of discovery, to infect 800,000 Android users between 2016 and 2019.
• Cornelia, GA Avoids Data Loss After Third Ransomware Attack This Year: The city of Cornelia, Georgia avoided data loss after suffering its third ransomware attack in 2019. The attack only disrupted the municipality’s systems for a day, but even so, city officials decided to invest in a new firewall and look into upgrading other parts of their government’s security infrastructure.
• Attor Espionage Platform Targeting Governments, Diplomatic Missions: Researchers at ESET discovered a new digital espionage campaign called Attor that used Tor for its network communications. They found that Attor used AT commands to conduct GSM fingerprinting and arrived with several measures designed to help the threat avoid detection.

Security Tip of the Week: Strengthen Your Mobile Security Posture

Defense against adware-laden apps and other mobile threats should start with a unified endpoint management (UEM) solution. This tool should be capable of analyzing how mobile devices and other IT assets interact with the network. Security personnel can then use the solution to respond to any malicious activity that’s observed.

While searching for a UEM platform, infosec professionals should ideally choose technology that uses artificial intelligence (AI) to correlate information about a potential threat, as such capabilities will help empower them to make better, more informed decisions about their systems’ security.