Fraudulent Photo App Operation Detected on Google Store

guest · Jul 24, 2020

Fraudulent Photo App Operation Detected on Google Store
July 23, 2020
https://www.infosecurity-magazine.com/news/white-ops-chartreuse-blur/

Researchers have exposed a malicious cyber-operation involving fraudulent photo-editing apps, none of which were found to function as advertised.

New research published today by White Ops’ Satori threat intelligence team revealed 29 fraudulent apps to be part of a nefarious cyber-scheme that they have named Chartreuse Blur.
The apps, which have already been downloaded 3.5 million times from the Google Play Store, cause out-of-context (OOC) ads to run rampant on a compromised device and randomly open web browsers while the device is in use.

Almost immediately upon installation, the app icon disappears from the device’s home screen, making it incredibly difficult for users to find and remove.
Click to expand...

The name Chartreuse Blur was given to the operation because the majority of the apps involved are masquerading as photo editors and include the world "blur" in their package name.

“If the app you’ve just downloaded is playing hide and seek with you, the icon disappearing from your home screen, it might be bogus,” warned researchers.
“The developer name for Square Photo Blur — 'Thomas Mary' — is almost certainly bogus,” noted researchers.
“All of the apps in this investigation feature developers whose 'names' are common English language names smashed together, seemingly at random.”
Click to expand...

White Ops: Bringing Blur Apps Into Focus

The Satori Team continues to monitor this threat and will identify any emerging adaptations and new apps. We recommend removal of any apps identified in Appendix A.

The threat actors are upping the game as seen in this analysis, using a multi-stage payload process to evade detection and get their malicious code to render. Given it is unrealistic that users should reverse engineer every mobile app before installing it, here are some questions a user can ask to help identify potential fraudulent ones: [...]
If the answer is yes to any of the above, then it might be bogus.
Click to expand...

Log in or Sign up

Fraudulent Photo App Operation Detected on Google Store

guest Guest

Log in or Sign up

Fraudulent Photo App Operation Detected on Google Store

guest Guest

Useful Searches