Researchers at mobile security firm Lookout have come across a new malicious adware family distributed via trojanized versions of popular Android applications.
The new threat, dubbed by the security company “Shuanet,” has been found in numerous Android programs, including Okta’s two-factor authentication application.
Similar to other recently discovered malicious adware families, such as Kemoge (ShiftyBug) and Shedun (GhostPush), Shuanet is designed to root the infected phone without the user’s knowledge, allowing attackers to gain unrestricted access to the device and prevent the victim from removing the threat.
The security firm has identified a total of over 20,000 popular Android applications containing Kemoge, Shedun and Shuanet. The highest infection rates have been observed in the United States, Germany, Iran, Russia, India, Jamaica, Sudan, Brazil, Mexico and Indonesia.
Attackers have repackaged popular applications taken from Google Play and other app stores and made them available on third-party websites. Many of the repackaged versions are fully functional, which helps them avoid raising suspicion.
While thousands of popular apps have been programmatically repackaged, experts believe malicious actors have specifically excluded antiviruses, which shows a high level of planning.
Lookout researchers believe that while Kemoge, Shedun and Shuanet are not created by the same individual or group, the adware families are linked. Some variants of these threats share between 71 and 82 percent of their code, which indicates that they use the same code base.
Kemoge uses a total of eight exploits to root devices, three of which are also leveraged by Shuanet. It’s worth noting that these exploits are not new and have been used by popular rooting tools.
According to experts, removing these threats from a device is not an easy task since once they gain root access they install themselves as system applications. Some consumers might be forced to replace their devices in order to get rid of them. Since the attackers have also targeted enterprise applications such as Okta’s 2FA app, organizations are also at risk.
“While historically adware hoped to convince the user to install new applications by showing banners and annoying pop ups, now it can install these third party apps without user consent. In this way it can heavily capitalize on the Cost Per Install paid out by web marketing companies,” Lookout’s Michael Bentley said in a blog post. “Unfortunately, should the revenue model change on clicks-per-install and ads, this may lead to malware authors using this privilege escalation for new monetization strategies.”
Last month, Palo Alto Networks warned that 18,000 Android applications built using an SDK from a Chinese mobile ad platform had SMS theft capabilities.
iOS users are also at risk. FireEye warned this week that a potentially backdoored version of a popular Chinese ad library has been found in thousands of iOS apps, and that the XcodeGhost malware has been updated to target iOS 9.
Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- 900 US Schools Impacted by MOVEit Hack at National Student Clearinghouse
- Predator Spyware Delivered to iOS, Android Devices via Zero-Days, MitM Attacks
- China’s Offensive Cyber Operations in Africa Support Soft Power Efforts
- SANS Survey Shows Drop in 2023 ICS/OT Security Budgets
- Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones
- Cisco to Acquire Splunk for $28 Billion
- Car Cybersecurity Study Shows Drop in Critical Vulnerabilities Over Past Decade
- Omron Patches PLC, Engineering Software Flaws Discovered During ICS Malware Analysis
Latest News
- Stealthy APT Gelsemium Seen Targeting Southeast Asian Government
- Nigerian Pleads Guilty in US to Million-Dollar BEC Scheme Role
- 900 US Schools Impacted by MOVEit Hack at National Student Clearinghouse
- City of Dallas Details Ransomware Attack Impact, Costs
- In-the-Wild Exploitation Expected for Critical TeamCity Flaw Allowing Server Takeover
- Predator Spyware Delivered to iOS, Android Devices via Zero-Days, MitM Attacks
- Researchers Discover Attempt to Infect Leading Egyptian Opposition Politician With Predator Spyware
- In Other News: New Analysis of Snowden Files, Yubico Goes Public, Election Hacking
