Last week in security news, researchers spotted 15 adware-laden Android apps lurking on the Google Play store that hid their icons after users installed them. Analysts also detected several phishing campaigns, including one that used certified email to deliver malware. Finally, news emerged of a city in Georgia that avoided data loss after suffering its third ransomware attack this year.

Top Story of the Week: Sneaky Android Adware on the Google Play Store

Security researchers at SophosLabs discovered 15 apps that had a combined total of 1.3 million downloads from Android users. After successful installation, each of these apps displayed a fake error message and redirected users to Google Maps to trick them into thinking there was a problem with installation. The app then hid its own icon to establish persistence on the infected device so it could begin aggressively serving up ads.

SophosLabs notified Google about these malicious programs back in July 2019. According to the security firm’s research, Google’s teams responded by removing the apps from Google Play.


Source: iStock

Also in Security News

  • Digi Phishing Campaign Offers a Fake Prize to Users: Heimdal Security detected a phishing campaign that impersonated the Digi brand and informed users that they were eligible to receive a smartphone gift. The campaign then redirected users to additional pages designed to steal their credit card details along with information about their devices and web connection.
  • sLoad Malware Operation Abuses Certified Email to Target Italian Users: In a campaign observed by Cybaze-Yoroi ZLAB, Italian organizations and consultants received certified emails that attempted to trick users into opening a ZIP archive. When opened, the attachment launched a VBS script that ran additional scripts and ultimately installed the final sLoad payload.
  • Security Incidents Not Reported by Two-Thirds of Industrial Organizations: Sixty-seven percent of industrial organizations told Kaspersky Lab that they don’t report digital security incidents to regulators. Notwithstanding that finding, more than half (55 percent) of respondents said that regulatory compliance demands constituted the top driver for strategizing their security investments.
  • FIN6 Preyed on Thousands of Online Shops Using Magecart Attack: Trend Micro discovered an online payment card skimming attack that began on Sept. 7, 2019 and affected approximately 3,126 online shops within the span of a month. Following a deep analysis, Trend Micro attributed the campaign to Magecart Group 6 (also known as FIN6).
  • Close to a Million Android Devices Enslaved by Geost Botnet Since 2016: An international group of researchers uncovered a new botnet called Geost that compromised legitimate apps available for download on the Google Play store using malicious code. This technique enabled the threat, which leveraged 13 command-and-control (C&C) servers and hundreds of domains at the time of discovery, to infect 800,000 Android users between 2016 and 2019.
  • Cornelia, GA Avoids Data Loss After Third Ransomware Attack This Year: The city of Cornelia, Georgia avoided data loss after suffering its third ransomware attack in 2019. The attack only disrupted the municipality’s systems for a day, but even so, city officials decided to invest in a new firewall and look into upgrading other parts of their government’s security infrastructure.
  • Attor Espionage Platform Targeting Governments, Diplomatic Missions: Researchers at ESET discovered a new digital espionage campaign called Attor that used Tor for its network communications. They found that Attor used AT commands to conduct GSM fingerprinting and arrived with several measures designed to help the threat avoid detection.

Security Tip of the Week: Strengthen Your Mobile Security Posture

Defense against adware-laden apps and other mobile threats should start with a unified endpoint management (UEM) solution. This tool should be capable of analyzing how mobile devices and other IT assets interact with the network. Security personnel can then use the solution to respond to any malicious activity that’s observed.

While searching for a UEM platform, infosec professionals should ideally choose technology that uses artificial intelligence (AI) to correlate information about a potential threat, as such capabilities will help empower them to make better, more informed decisions about their systems’ security.

More from

Did Brazil DSL Modem Attacks Change Device Security?

From 2011 to 2012, millions of Internet users in Brazil fell victim to a massive attack against vulnerable DSL modems. By configuring the modems remotely, attackers could redirect users to malicious domain name system (DNS) servers. Victims trying to visit popular websites (Google, Facebook) were instead directed to imposter sites. These rogue sites then installed malware on victims' computers.According to a report from Kaspersky Lab Expert Fabio Assolini citing statistics from Brazil's Computer Emergency Response Team, the attack ultimately infected…

Who Carries the Weight of a Cyberattack?

Almost immediately after a company discovers a data breach, the finger-pointing begins. Who is to blame? Most often, it is the chief information security officer (CISO) or chief security officer (CSO) because protecting the network infrastructure is their job. Heck, it is even in their job title: they are the security officer. Security is their responsibility. But is that fair – or even right? After all, the most common sources of data breaches and other cyber incidents are situations caused…

Transitioning to Quantum-Safe Encryption

With their vast increase in computing power, quantum computers promise to revolutionize many fields. Artificial intelligence, medicine and space exploration all benefit from this technological leap — but that power is also a double-edged sword. The risk is that threat actors could abuse quantum computers to break the key cryptographic algorithms we depend upon for the safety of our digital world. This poses a threat to a wide range of critical areas. Fortunately, alternate cryptographic algorithms that are safe against…

Securing Your SAP Environments: Going Beyond Access Control

Many large businesses run SAP to manage their business operations and their customer relations. Security has become an increasingly critical priority due to the ongoing digitalization of society and the new opportunities that attackers exploit to achieve a system breach. Recent attacks related to corrupt data, stealing personal information and escalating privileges for remote code execution all highlight the new and varied entry points threat actors have taken advantage of. Attackers with the appropriate skills could be able to exploit…