Oscorp, a new Android malware targets Italian users

guest · Jan 28, 2021

Oscorp, a new Android malware targets Italian users
January 29, 2021
https://securityaffairs.co/wordpress/113983/malware/oscorp-android-malware.html

Researchers from security firm AddressIntel spotted a new Android malware dubbed Oscorp, its name comes from the title of the login page of its command-and-control server.

Like other Android malware, the Oscorp malware trick users into granting them access to the Android Accessibility Service, this means they will be able to read the text on the phone screen, determine an app installation prompt, scroll through the permission list and press the install button on the behalf of the user.

“not being able to access the private files of other applications, the actions of these malicious apps are “limited” to the theft of credentials through phishing pages (called, in the jargon of malware, injections), to blocking the device (intended as screen lock) and possibly to the capture of audio and video.” read the advisory published by Italy’s CERT-AGID (Italian language).
Click to expand...

The CERT’s report provides technical details about the malware, such as the description of the services such as the PJService used to collect info on the device. The malware communicates with the C2 via HTTP POST requests.

“Android protections prevent malware from doing any kind of damage until the user enables accessibility service,” concludes the CERT-AGID’s advisory. “Once enabled, however, a ‘dam’ opens up. In fact, Android has always had a very permissive policy towards app developers, leaving the ultimate decision to trust an app or not to the end user.”
Click to expand...

Log in or Sign up

Oscorp, a new Android malware targets Italian users

guest Guest

Log in or Sign up

Oscorp, a new Android malware targets Italian users

guest Guest

Useful Searches