Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Google Play Apps Infected with Malicious IFrames

Summary: Unit 42 found 132 Android apps on Google Play carrying hidden 1-pixel or display:none IFrames pointing to two malicious domains, with the most popular app exceeding 10,000 installs. The 132 apps came from seven unrelated developers all connected to Indonesia, and Unit 42 assesses the developers were victims of an infected development platform or IDE rather than the attackers; Google removed all infected apps after the report.

Key Takeaway: The developers' own build environments were the infection vector, so the apps shipped clean-looking HTML that only revealed a hidden IFrame at the end of each page - and one sample also tried to drop a Windows executable, showing the same pipeline can carry cross-platform payloads. Unit 42 notes an attacker could swap the dead sinkholed domains for ad URLs or use the enabled JavaScriptInterface to reach native app functionality, putting whatever data the app sends to the developer's server under an outside party's control.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related