November 13, 2017 By Shane Schick 2 min read

Android users may be spending more time on malware removal following the discovery of an exploit associated with the Toast feature in Google’s operating system.

ToastAmigo Uses Toast Overlay Attack

Researchers at Trend Micro first warned users about the malware removal work back in September when Google patched the vulnerability. Identified as ToastAmigo, the Toast overlay attack allows notifications to display on top of other applications.

The attack fools Android users into downloading a fictitious security tool called Smart Applocker. While the app supposedly scans a device for security issues and shows progress using Android’s Toast feature, a second piece of malware, dubbed AmigoClicker, infects the smartphone. The threat can then gain access to other apps, collect information from Google accounts and even rate itself on Google Play.

According to SecurityWeek, the cybercriminals targeted Android’s Toast feature because it masks the smartphone’s display while they do their dirty work. It also doesn’t require attackers to make numerous requests that might arouse suspicion. The persistence of the technique ensures that, even once it has been discovered, malware removal might prove time-consuming and difficult.

Industry Response

Google was well-aware that Android Toast could prove attractive to cybercriminals. It conducted a proof-of-concept test involving a similar attack earlier this year, but this proved more difficult to execute than ToastAmigo, SC Magazine reported. The company then offered a fix in the hopes that it wouldn’t have yet another malware situation on its hands.

As the name implies, Toast works almost like a pop-up on the user’s screen. This makes an overlay attack harder to spot because cybercriminals can set legitimate-looking content over something that would otherwise clearly be a candidate for malware removal.

Google is taking action based on ToastAmigo, Android Soul reported. Because the Toast overlay attack is hijacking features to get at user data, app developers are being asked not to make use of Accessibility Services in Android unless the software offers disability assistance. Failure to comply could result in those apps being pulled from Google Play — before users flag any other malware removal issues.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today