PhantomLance spying campaign breaches Google Play security

guest · Apr 28, 2020

PhantomLance spying campaign breaches Google Play security
The four-year-long attack wave has been connected to dozens of malicious apps found in app stores
April 28, 2020
https://www.zdnet.com/article/phantomlance-spying-campaign-breaches-google-play-security/

Kaspersky has warned of an ongoing campaign in which malicious apps hosted by Google Play are covertly spying and stealing Android user data.
On Tuesday, cybersecurity researchers said the campaign, dubbed PhantomLance, has been active for at least four years and is ongoing.

According to the team, "dozens" of malicious apps connected to PhantomLance and harboring a new Trojan have been discovered in Google Play, the tech giant's official Android mobile application repository. In addition, malicious apps have also been found on the APK download site APKpure.
[...] PhantomLance is not the work of run-of-the-mill threat actors.
Click to expand...

Kaspersky suspects an Advanced Persistent Threat (APT) group may be behind the campaign due to the care taken to mask its tracks. In "almost every case," the team says, fake developer profiles were created with associated GitHub accounts, and in order to avoid detection, the first version of each app uploaded to Google Play or APKpure did not contain malicious code.

"With later updates, applications received both malicious payloads and a code to drop and execute these payloads," Kaspersky says.
"PhantomLance has been going on for over five years and the threat actors managed to bypass the app stores' filters several times, using advanced techniques to achieve their goals," says said Alexey Firsh, a Kaspersky researcher.
Click to expand...

Kaspersky: Hiding in plain sight: PhantomLance walks into a market

Log in or Sign up

PhantomLance spying campaign breaches Google Play security

guest Guest

Log in or Sign up

PhantomLance spying campaign breaches Google Play security

guest Guest

Useful Searches