MobSTSPY Spyware Finds Its Way Into Google Play

Spyware camouflaged as Android applications has found its way into the Google Play store, and a part of the malicious applications being downloaded multiple times by users across the world last year.

Identified as ANDROIDOS_MOBSTSPY and named MobSTSPY, Trend Micro specialists said the malware initially grabbed their attention when it was disguised as a called Flappy Birr Dog.

Upon further examination, researchers found the spyware was likewise covered up in different applications including Win7imulator, FlashLight, Win7Launcher, HZPermis Pro Arabe, and Flappy Bird.

The malware has the ability to read SMS discussions, access to contact list, and call logs and can take and upload documents on the device if the directions are given and use Firebase Cloud Messaging to send data to its server.

MobSTSPY can likewise collect data by means of phishing attack imitating Facebook and Google credential ask for pop-ups to steal client’s record subtleties. Indeed, even after entering the credentials, the windows will be pop up to say that the login was unsuccessful.

“Part of what makes this case interesting is how widely its applications have been distributed,” researchers said in the post. “Through our back-end monitoring and deep research, we were able to see the general distribution of affected users and found that they hailed from a total of 196 different countries.”

Researchers noted infections in Mozambique, Poland, Iran, Vietnam, Algeria, Thailand, Romania, Italy, Morocco, Mexico, Malaysia, Germany, Iraq, South Africa, Sri Lanka, Saudi Arabia, Philippines, Argentina, Cambodia, Belarus, Kazakhstan, Tanzania and the United Republic of Hungary.

When infected the malware first checks the gadget’s system accessibility at that point peruses and parses an XML file from its command and control server in this way enlisting the gadget. When done, the malware will hang tight for and perform directions sent from its C&C server through FCM

Researchers noted that five out of six of the apps had been removed from the Google Play store since February 2018 and that and that as of writing all of the malicious apps had been removed.

To prevent from getting infected, researchers recommend users install a comprehensive cybersecurity solution to defend their mobile devices against mobile malware.