October 14, 2019 By David Bisson 3 min read

Last week in security news, researchers spotted 15 adware-laden Android apps lurking on the Google Play store that hid their icons after users installed them. Analysts also detected several phishing campaigns, including one that used certified email to deliver malware. Finally, news emerged of a city in Georgia that avoided data loss after suffering its third ransomware attack this year.

Top Story of the Week: Sneaky Android Adware on the Google Play Store

Security researchers at SophosLabs discovered 15 apps that had a combined total of 1.3 million downloads from Android users. After successful installation, each of these apps displayed a fake error message and redirected users to Google Maps to trick them into thinking there was a problem with installation. The app then hid its own icon to establish persistence on the infected device so it could begin aggressively serving up ads.

SophosLabs notified Google about these malicious programs back in July 2019. According to the security firm’s research, Google’s teams responded by removing the apps from Google Play.


Source: iStock

Also in Security News

  • Digi Phishing Campaign Offers a Fake Prize to Users: Heimdal Security detected a phishing campaign that impersonated the Digi brand and informed users that they were eligible to receive a smartphone gift. The campaign then redirected users to additional pages designed to steal their credit card details along with information about their devices and web connection.
  • sLoad Malware Operation Abuses Certified Email to Target Italian Users: In a campaign observed by Cybaze-Yoroi ZLAB, Italian organizations and consultants received certified emails that attempted to trick users into opening a ZIP archive. When opened, the attachment launched a VBS script that ran additional scripts and ultimately installed the final sLoad payload.
  • Security Incidents Not Reported by Two-Thirds of Industrial Organizations: Sixty-seven percent of industrial organizations told Kaspersky Lab that they don’t report digital security incidents to regulators. Notwithstanding that finding, more than half (55 percent) of respondents said that regulatory compliance demands constituted the top driver for strategizing their security investments.
  • FIN6 Preyed on Thousands of Online Shops Using Magecart Attack: Trend Micro discovered an online payment card skimming attack that began on Sept. 7, 2019 and affected approximately 3,126 online shops within the span of a month. Following a deep analysis, Trend Micro attributed the campaign to Magecart Group 6 (also known as FIN6).
  • Close to a Million Android Devices Enslaved by Geost Botnet Since 2016: An international group of researchers uncovered a new botnet called Geost that compromised legitimate apps available for download on the Google Play store using malicious code. This technique enabled the threat, which leveraged 13 command-and-control (C&C) servers and hundreds of domains at the time of discovery, to infect 800,000 Android users between 2016 and 2019.
  • Cornelia, GA Avoids Data Loss After Third Ransomware Attack This Year: The city of Cornelia, Georgia avoided data loss after suffering its third ransomware attack in 2019. The attack only disrupted the municipality’s systems for a day, but even so, city officials decided to invest in a new firewall and look into upgrading other parts of their government’s security infrastructure.
  • Attor Espionage Platform Targeting Governments, Diplomatic Missions: Researchers at ESET discovered a new digital espionage campaign called Attor that used Tor for its network communications. They found that Attor used AT commands to conduct GSM fingerprinting and arrived with several measures designed to help the threat avoid detection.

Security Tip of the Week: Strengthen Your Mobile Security Posture

Defense against adware-laden apps and other mobile threats should start with a unified endpoint management (UEM) solution. This tool should be capable of analyzing how mobile devices and other IT assets interact with the network. Security personnel can then use the solution to respond to any malicious activity that’s observed.

While searching for a UEM platform, infosec professionals should ideally choose technology that uses artificial intelligence (AI) to correlate information about a potential threat, as such capabilities will help empower them to make better, more informed decisions about their systems’ security.

More from

CVE-2023-20078 technical analysis: Identifying and triggering a command injection vulnerability in Cisco IP phones

7 min read - CVE-2023-20078 catalogs an unauthenticated command injection vulnerability in the web-based management interface of Cisco 6800, 7800, and 8800 Series IP Phones with Multiplatform Firmware installed; however, limited technical analysis is publicly available. This article presents my findings while researching this vulnerability. In the end, the reader should be equipped with the information necessary to understand and trigger this vulnerability.Vulnerability detailsThe following Cisco Security Advisory (Cisco IP Phone 6800, 7800, and 8800 Series Web UI Vulnerabilities - Cisco) details CVE-2023-20078 and…

X-Force data reveals top spam trends, campaigns and senior superlatives in 2023

10 min read - The 2024 IBM X-Force Threat Intelligence Index revealed attackers continued to pivot to evade detection to deliver their malware in 2023. The good news? Security improvements, such as Microsoft blocking macro execution by default starting in 2022 and OneNote embedded files with potentially dangerous extensions by mid-2023, have changed the threat landscape for the better. Improved endpoint detection also likely forced attackers to shift away from other techniques prominent in 2022, such as using disk image files (e.g. ISO) and…

The compelling need for cloud-native data protection

4 min read - Cloud environments were frequent targets for cyber attackers in 2023. Eighty-two percent of breaches that involved data stored in the cloud were in public, private or multi-cloud environments. Attackers gained the most access to multi-cloud environments, with 39% of breaches spanning multi-cloud environments because of the more complicated security issues. The cost of these cloud breaches totaled $4.75 million, higher than the average cost of $4.45 million for all data breaches.The reason for this high cost is not only the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today