New 'unremovable' xHelper malware has infected 45,000 Android devices

guest · Oct 29, 2019

New 'unremovable' xHelper malware has infected 45,000 Android devices
Factory resets aren't helping. Neither are mobile antivirus solutions. Malware keeps reinstalling itself
October 29, 2019
https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Over the past six months, a new Android malware strain has made a name for itself after popping up on the radar of several antivirus companies, and annoying users thanks to a self-reinstall mechanism that has made it near impossible to remove.

Named xHelper, this malware was first spotted back in March but slowly expanded to infect more than 32,000 devices by August (per Malwarebytes), eventually reaching a total of 45,000 infections this month (per Symantec).
The malware is on a clear upward trajectory. Symantec says the xHelper crew is making on average 131 new victims per day and around 2,400 new victims per month.
INSTALLED VIA THIRD-PARTY APPS
According to Malwarebytes, the source of these infections is "web redirects" that send users to web pages hosting Android apps. These sites instruct users on how to side-load unofficial Android apps from outside the Play Store. Code hidden in these apps downloads the xHelper trojan.

The good news is that the trojan doesn't carry out destructive operations.
Click to expand...

Symantec: Xhelper: Persistent Android dropper app infects 45K devices in past 6 months

guest · Oct 30, 2019

This crazy bit of malware is the best reason to use only Google Play to get your apps
October 30, 2019
https://www.androidcentral.com/crazy-bit-malware-best-reason-only-use-google-play-get-your-apps

There's a scary bit of malware floating out there in the wild. Known as xHelper, it's not what the malware does once installed that's so bad, but how it keeps itself installed.

What's so bad about this one is that the malware keeps finding a way to reinstall itself once it's been uninstalled, even if you factory reset your phone.
There are several different theories about how this could be happening.
[...] Another idea, and the one that makes the most sense to me, is that app data backups through Google's own service contain whatever is needed for xHelper to find its way back into your phone.

But this whole mess tells us one thing pretty clearly: unless you know how to make sure an app is clean and safe, stick to Google Play for all of your apps.
Click to expand...

Minimalist · Feb 13, 2020

Nasty Android malware reinfects its targets, and no one knows how

A widely circulating piece of Android malware primarily targeting US-based phones used a clever trick to reinfect one of its targets in a feat that stumped researchers as to precisely how it was pulled off.
Click to expand...

https://arstechnica.com/information...y-android-infection-survived-a-factory-reset/

guest · Apr 7, 2020

Unveiled: How xHelper Android Malware Re-Installs Even After Factory Reset
April 7, 2020
https://thehackernews.com/2020/04/how-to-remove-xhelper-malware.html?utm_source=feedburner

A mysterious piece of Android malware that re-installs itself on infected devices even after users delete it or factory reset their devices—making it nearly impossible to remove.

xHelper reportedly infected over 45,000 devices last year, and since then, cybersecurity researchers have been trying to unfold how the malware survives factory reset and how it infected so many devices in the first place.
In a blog post published today, Igor Golovin, malware analyst at Kaspersky, finally solved the mystery by unveiling technical details on the persistence mechanism used by this malware, and eventually also figured out how to remove xHelper from an infected device completely.
Click to expand...

What's more interesting is that though a legitimate security app or affected user could have simply re-mount the system partition, in the same way, to permanently delete the malware file, xHelper also modifies a system library (libc.so) intending to prevent infected users from re-mounting system partition in the write mode.

"On top of that, the Trojan downloads and installs several more malicious programs, and deletes root access control applications, such as Superuser," Golovin said.

However, instead of following such a tech-savvy procedure to get rid of the malware, affected users are advised to simply re-flash their backdoored phones with a fresh copy of firmware downloaded from the vendors' official website or by installing a different but compatible Android ROM.
Click to expand...

Kaspersky: Unkillable xHelper and a Trojan matryoshka

The main feature of xHelper is entrenchment — once it gets into the phone, it somehow remains there even after the user deletes it and restores the factory settings. We conducted a thorough study to determine how xHelper’s creators furnished it with such survivability.
Click to expand...

Log in or Sign up

New 'unremovable' xHelper malware has infected 45,000 Android devices

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Log in or Sign up

New 'unremovable' xHelper malware has infected 45,000 Android devices

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Useful Searches