CallerSpy spyware: Possibly the first phase of a targeted attack

mood · Dec 2, 2019

CallerSpy spyware: Possibly the first phase of a targeted attack
December 2, 2019
https://www.scmagazine.com/home/sec...ossibly-the-first-phase-of-a-targeted-attack/

A new cyberespionage tool called CallerSpy was revealed by Trend Micro, but exactly what the developer’s intentions are for the malware is still unknown.

CallerSpy was first spotted in May on the typosquatted website http://gooogle[.]press/ where it was advertised as a chat app called Chatrious. Using the misspelled Google name in the URL appears to be the main method of attracting victims and the website goes an extra step by placing fake Google corporate copyright details on the page.
The security company believes CallerSpy could be the initial phase of a larger campaign that has either not been fully initiated or even launched as no victims have been spotted nor any detections for it seen on VirusTotal.

The app’s only ability is to steal information. In many cases threat actors build into the app the advertised capability in order to further camouflage the app’s true malicious nature, but CallerSpy’s only ability is to steal information.
This includes taking screenshots, collecting call logs, SMSs, contacts and files on the device. This content is stored locally and then periodically uploaded to the server.
Click to expand...

Trend Micro: Mobile Cyberespionage Campaign Distributed Through CallerSpy Mounts Initial Phase of a Targeted Attack

Based on the aforementioned clues and past findings, we believe that this is a new campaign. There have been no detections for it on VirusTotal at the time of writing.

The campaign’s target is still unclear because we have not seen actual victims.
So far, our monitoring has not found any volume infection, which could mean that the threat actor may be waiting for a chance to spread the malware.
Click to expand...

Log in or Sign up

CallerSpy spyware: Possibly the first phase of a targeted attack

mood Updates Team