Exaspy Spyware Is Available as a Service

Spyware packages for mobile phones have existed for a while, but the malware type is changing how it spreads.

Skycure Research Labs found one nasty piece of spyware known as Exaspy that works on Android phones and is rather complete in how it sucks up data. Most worryingly, it is available as a commodity service online — spyware-as-a-service, so to speak.

A Sophisticated Snooper

According to Threatpost, Exaspy spyware can intercept messages from all manner of communications, including SMS, MMS, Facebook Messenger, Google Hangouts, Skype, Gmail, native email, Viber, WhatsApp and more. It can also record background audio and telephone calls.

Additionally, the malware has the ability to access the device’s picture library and take secret screenshots on infected devices. This is a sophisticated snooper, for sure.

Physical Access Required

“Interestingly, this malware actually requires an end user to perform the initial installation steps, meaning physical access to the device is required at installation time,” security researcher Elisha Eshed wrote on the Skycure Research Labs blog.

It is possible that Exaspy requests access to device admin rights upon booting. Granting that kind of request likely requires a click action. The malware also installs itself as a system package to prevent the user from removing it, among other tricks to promote its effectiveness.

In any case, Skycure found this malware on an Android 6.0.1 device. It showed up as a fake app called Google Services running with full administrative rights. According to the researchers, the phone belonged to the vice president of a global technology company.

Classic antivirus detection software usually misses this kind of spyware. It doesn’t seem to contain a static signature that can be used for detection. This may be because the malware changes as its command-and-control (C&C) server issues different instructions for different kinds of information it seeks to steal.

Stopping Exaspy Spyware

Skycure advised users to set up PIN codes and fingerprint authentication on their phones. Users should also disable USB debugging and original equipment manufacturer (OEM) unlocking to protect their mobile devices from unwanted apps.

In short, phones need to be hardened to resist this kind of spyware.

Larry Loeb

Principal, PBC Enterprises

NIST’s role in the global tech race against AI

4 min read - Last year, the United States Secretary of Commerce announced that the National Institute of Standards and Technology (NIST) has been put in charge of launching a new public working group on artificial intelligence (AI) that will build on the success of the NIST AI Risk Management Framework to address this rapidly advancing technology.However, recent budget cuts at NIST, along with a lack of strategy implementation, have called into question the agency’s ability to lead this critical effort. Ultimately, the success…

Researchers develop malicious AI ‘worm’ targeting generative AI systems

2 min read - Researchers have created a new, never-seen-before kind of malware they call the "Morris II" worm, which uses popular AI services to spread itself, infect new systems and steal data. The name references the original Morris computer worm that wreaked havoc on the internet in 1988.The worm demonstrates the potential dangers of AI security threats and creates a new urgency around securing AI models.New worm utilizes adversarial self-replicating promptThe researchers from Cornell Tech, the Israel Institute of Technology and Intuit, used what’s…

Passwords, passkeys and familiarity bias

5 min read - As passkey (passwordless authentication) adoption proceeds, misconceptions abound. There appears to be a widespread impression that passkeys may be more convenient and less secure than passwords. The reality is that they are both more secure and more convenient — possibly a first in cybersecurity.Most of us could be forgiven for not realizing passwordless authentication is more secure than passwords. Thinking back to the first couple of use cases I was exposed to — a phone operating system (OS) and a…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

A Sophisticated Snooper

Physical Access Required

Stopping Exaspy Spyware

More from

NIST’s role in the global tech race against AI

Researchers develop malicious AI ‘worm’ targeting generative AI systems

Passwords, passkeys and familiarity bias

Topic updates