Forest Global Training Partners

Cyber Risks · Krebs on Security

How Malicious Android Apps Slip Into Disguise

Summary: Researchers at ThreatFabric identified an Android obfuscation method that corrupts components of an app's .apk file so that security scanning tools reject the code as invalid while Android still installs and runs it, and in April 2023 the firm began finding many more variants of known mobile malware families using it. ThreatFabric attributed the increase to a semi-automated malware-as-a-service offering that obfuscates malicious apps for a fee, and Google, which rated the initial May 9, 2023 report as high severity and later paid a $5,000 bounty, said it updated its app malware detection mechanisms.

What you should know: ThreatFabric estimates the operators behind the Anatsa banking trojan, which poses as file managers and PDF viewers, have delivered more than 30,000 installations through Google Play campaigns, and Google acknowledged its own APK Analyzer still fails to parse such apps while devices install them anyway.

Read the original at Krebs on Security ↗

Topics
Malware
Related