October 14, 2019 By David Bisson 3 min read

Last week in security news, researchers spotted 15 adware-laden Android apps lurking on the Google Play store that hid their icons after users installed them. Analysts also detected several phishing campaigns, including one that used certified email to deliver malware. Finally, news emerged of a city in Georgia that avoided data loss after suffering its third ransomware attack this year.

Top Story of the Week: Sneaky Android Adware on the Google Play Store

Security researchers at SophosLabs discovered 15 apps that had a combined total of 1.3 million downloads from Android users. After successful installation, each of these apps displayed a fake error message and redirected users to Google Maps to trick them into thinking there was a problem with installation. The app then hid its own icon to establish persistence on the infected device so it could begin aggressively serving up ads.

SophosLabs notified Google about these malicious programs back in July 2019. According to the security firm’s research, Google’s teams responded by removing the apps from Google Play.


Source: iStock

Also in Security News

  • Digi Phishing Campaign Offers a Fake Prize to Users: Heimdal Security detected a phishing campaign that impersonated the Digi brand and informed users that they were eligible to receive a smartphone gift. The campaign then redirected users to additional pages designed to steal their credit card details along with information about their devices and web connection.
  • sLoad Malware Operation Abuses Certified Email to Target Italian Users: In a campaign observed by Cybaze-Yoroi ZLAB, Italian organizations and consultants received certified emails that attempted to trick users into opening a ZIP archive. When opened, the attachment launched a VBS script that ran additional scripts and ultimately installed the final sLoad payload.
  • Security Incidents Not Reported by Two-Thirds of Industrial Organizations: Sixty-seven percent of industrial organizations told Kaspersky Lab that they don’t report digital security incidents to regulators. Notwithstanding that finding, more than half (55 percent) of respondents said that regulatory compliance demands constituted the top driver for strategizing their security investments.
  • FIN6 Preyed on Thousands of Online Shops Using Magecart Attack: Trend Micro discovered an online payment card skimming attack that began on Sept. 7, 2019 and affected approximately 3,126 online shops within the span of a month. Following a deep analysis, Trend Micro attributed the campaign to Magecart Group 6 (also known as FIN6).
  • Close to a Million Android Devices Enslaved by Geost Botnet Since 2016: An international group of researchers uncovered a new botnet called Geost that compromised legitimate apps available for download on the Google Play store using malicious code. This technique enabled the threat, which leveraged 13 command-and-control (C&C) servers and hundreds of domains at the time of discovery, to infect 800,000 Android users between 2016 and 2019.
  • Cornelia, GA Avoids Data Loss After Third Ransomware Attack This Year: The city of Cornelia, Georgia avoided data loss after suffering its third ransomware attack in 2019. The attack only disrupted the municipality’s systems for a day, but even so, city officials decided to invest in a new firewall and look into upgrading other parts of their government’s security infrastructure.
  • Attor Espionage Platform Targeting Governments, Diplomatic Missions: Researchers at ESET discovered a new digital espionage campaign called Attor that used Tor for its network communications. They found that Attor used AT commands to conduct GSM fingerprinting and arrived with several measures designed to help the threat avoid detection.

Security Tip of the Week: Strengthen Your Mobile Security Posture

Defense against adware-laden apps and other mobile threats should start with a unified endpoint management (UEM) solution. This tool should be capable of analyzing how mobile devices and other IT assets interact with the network. Security personnel can then use the solution to respond to any malicious activity that’s observed.

While searching for a UEM platform, infosec professionals should ideally choose technology that uses artificial intelligence (AI) to correlate information about a potential threat, as such capabilities will help empower them to make better, more informed decisions about their systems’ security.

More from

What’s behind unchecked CVE proliferation, and what to do about it

4 min read - The volume of Common Vulnerabilities and Exposures (CVEs) has reached staggering levels, placing immense pressure on organizations' cyber defenses. According to SecurityScorecard, there were 29,000 vulnerabilities recorded in 2023, and by mid-2024, nearly 27,500 had already been identified.Meanwhile, Coalition's 2024 Cyber Threat Index forecasts that the total number of CVEs for 2024 will hit 34,888—a 25% increase compared to the previous year. This upward trend presents a significant challenge for organizations trying to manage vulnerabilities and mitigate potential exploits.What’s behind…

Quishing: A growing threat hiding in plain sight

4 min read - Our mobile devices go everywhere we go, and we can use them for almost anything. For businesses, the accessibility of mobile devices has also made it easier to create more interactive ways to introduce new products and services while improving user experiences across different industries. Quick-response (QR) codes are a good example of this in action and help mobile devices quickly navigate to web pages or install new software by simply scanning an image.However, legitimate organizations aren’t the only ones…

Cybersecurity Awareness Month: 5 new AI skills cyber pros need

4 min read - The rapid integration of artificial intelligence (AI) across industries, including cybersecurity, has sparked a sense of urgency among professionals. As organizations increasingly adopt AI tools to bolster security defenses, cyber professionals now face a pivotal question: What new skills do I need to stay relevant?October is Cybersecurity Awareness Month, which makes it the perfect time to address this pressing issue. With AI transforming threat detection, prevention and response, what better moment to explore the essential skills professionals might require?Whether you're…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today