Forest Global Training Partners

Cyber Risks · Cisco Talos

Arid Viper disguising mobile spyware as updates for non-malicious Android applications

Summary: Cisco Talos reports that Arid Viper is distributing Android malware called "Skipped_Messenger" disguised as updates for dating apps, using Google's Firebase messaging system as a command-and-control channel. The malware uses the same Firebase databases as the non-malicious Skipped dating app, but with its own distinct API keys and client IDs, which Talos assesses means the Skipped developers likely shared the Firebase project with Arid Viper operators.

Key Takeaway: Talos found the malware disables security notifications entirely on Samsung devices and on any device with an Android package containing the word "security," and dims them on Huawei, Google, Oppo and Xiaomi hardware - so the compromise can proceed without the user seeing a warning.

Read the original at Cisco Talos ↗

Topics
Malware
Related