Last week in security news, researchers spotted 15 adware-laden Android apps lurking on the Google Play store that hid their icons after users installed them. Analysts also detected several phishing campaigns, including one that used certified email to deliver malware. Finally, news emerged of a city in Georgia that avoided data loss after suffering its third ransomware attack this year.

Top Story of the Week: Sneaky Android Adware on the Google Play Store

Security researchers at SophosLabs discovered 15 apps that had a combined total of 1.3 million downloads from Android users. After successful installation, each of these apps displayed a fake error message and redirected users to Google Maps to trick them into thinking there was a problem with installation. The app then hid its own icon to establish persistence on the infected device so it could begin aggressively serving up ads.

SophosLabs notified Google about these malicious programs back in July 2019. According to the security firm’s research, Google’s teams responded by removing the apps from Google Play.

Source: iStock

Also in Security News

  • Digi Phishing Campaign Offers a Fake Prize to Users: Heimdal Security detected a phishing campaign that impersonated the Digi brand and informed users that they were eligible to receive a smartphone gift. The campaign then redirected users to additional pages designed to steal their credit card details along with information about their devices and web connection.
  • sLoad Malware Operation Abuses Certified Email to Target Italian Users: In a campaign observed by Cybaze-Yoroi ZLAB, Italian organizations and consultants received certified emails that attempted to trick users into opening a ZIP archive. When opened, the attachment launched a VBS script that ran additional scripts and ultimately installed the final sLoad payload.
  • Security Incidents Not Reported by Two-Thirds of Industrial Organizations: Sixty-seven percent of industrial organizations told Kaspersky Lab that they don’t report digital security incidents to regulators. Notwithstanding that finding, more than half (55 percent) of respondents said that regulatory compliance demands constituted the top driver for strategizing their security investments.
  • FIN6 Preyed on Thousands of Online Shops Using Magecart Attack: Trend Micro discovered an online payment card skimming attack that began on Sept. 7, 2019 and affected approximately 3,126 online shops within the span of a month. Following a deep analysis, Trend Micro attributed the campaign to Magecart Group 6 (also known as FIN6).
  • Close to a Million Android Devices Enslaved by Geost Botnet Since 2016: An international group of researchers uncovered a new botnet called Geost that compromised legitimate apps available for download on the Google Play store using malicious code. This technique enabled the threat, which leveraged 13 command-and-control (C&C) servers and hundreds of domains at the time of discovery, to infect 800,000 Android users between 2016 and 2019.
  • Cornelia, GA Avoids Data Loss After Third Ransomware Attack This Year: The city of Cornelia, Georgia avoided data loss after suffering its third ransomware attack in 2019. The attack only disrupted the municipality’s systems for a day, but even so, city officials decided to invest in a new firewall and look into upgrading other parts of their government’s security infrastructure.
  • Attor Espionage Platform Targeting Governments, Diplomatic Missions: Researchers at ESET discovered a new digital espionage campaign called Attor that used Tor for its network communications. They found that Attor used AT commands to conduct GSM fingerprinting and arrived with several measures designed to help the threat avoid detection.

Security Tip of the Week: Strengthen Your Mobile Security Posture

Defense against adware-laden apps and other mobile threats should start with a unified endpoint management (UEM) solution. This tool should be capable of analyzing how mobile devices and other IT assets interact with the network. Security personnel can then use the solution to respond to any malicious activity that’s observed.

While searching for a UEM platform, infosec professionals should ideally choose technology that uses artificial intelligence (AI) to correlate information about a potential threat, as such capabilities will help empower them to make better, more informed decisions about their systems’ security.

More from

More School Closings Coast-to-Coast Due to Ransomware

Instead of snow days, students now get cyber days off. Cyberattacks are affecting school districts of all sizes from coast-to-coast. Some schools even completely shut down due to the attacks. The federal government recently warned that K-12 schools face a growing threat from cyber groups. According to the FBI, school districts often have limited cybersecurity protections, which makes them even more vulnerable. The FBI also says it anticipates the number of threats to increase. In a recent warning, the nation’s…

The Role of Human Resources in Cybersecurity

The human resources (HR) department is an integral part of an organization. They work with all departments with a wider reach than even IT. As a highly visible department, HR can support and improve an organization’s security posture through employee training. Their access to employees at the start of employment is an opportunity to lay a foundation for a culture of risk awareness. HR departments do not typically include cybersecurity risk awareness training with new hire onboarding, but it’s something…

New Attack Targets Online Customer Service Channels

An unknown attacker group is targeting customer service agents at gambling and gaming companies with a new malware effort. Known as IceBreaker, the code is capable of stealing passwords and cookies, exfiltrating files, taking screenshots and running custom VBS scripts. While these are fairly standard functions, what sets IceBreaker apart is its infection vector. Malicious actors are leveraging the helpful nature of customer service agents to deliver their payload and drive the infection process. Here’s a look at how IceBreaker…

Operational Technology: The evolving threats that might shift regulatory policy

Listen to this podcast on Apple Podcasts, Spotify or wherever you find your favorite audio content. Attacks on Operational Technology (OT) and Industrial Control Systems (ICS) grabbed the headlines more often in 2022 — a direct result of Russia’s invasion of Ukraine sparking a growing willingness on behalf of criminals to target the ICS of critical infrastructure. Conversations about what could happen if these kinds of systems were compromised were once relegated to “what ifs” and disaster movie scripts. But those days are…