Researchers Discover PhoneSpy Malware Spying on South Korean Citizens

guest · Nov 10, 2021

Researchers Discover PhoneSpy Malware Spying on South Korean Citizens
November 10, 2021
https://thehackernews.com/2021/11/researchers-discover-phonespy-malware.html

An ongoing mobile spyware campaign has been uncovered snooping on South Korean residents using a family of 23 malicious Android apps to siphon sensitive information and gain remote control of the devices.

"With more than a thousand South Korean victims, the malicious group behind this invasive campaign has had access to all the data, communications, and services on their devices," Zimperium researcher Aazim Yaswant said. "The victims were broadcasting their private information to the malicious actors with zero indication that something was amiss."
The Dallas-based mobile security company dubbed the campaign "PhoneSpy."
Click to expand...

Post installation, the application requests for a wide range of permissions before opening a phishing site that's designed to resemble the login pages of popular apps such as Facebook, Instagram, Google, and Kakao Talk. Users who attempt to sign in, however, are greeted by a HTTP 404 Not Found message, but in reality, have their credentials stolen and exfiltrated to a remote command-and-control (C2) server.

"Many of the applications are facades of a real app with none of the advertised user-based functionality," Yaswant explained. "In a few other cases, like simpler apps that advertise as photo viewers, the app will work as advertised all while the PhoneSpy spyware is working in the background."
Click to expand...

Like other trojans, PhoneSpy abuses its entrenched permissions, enabling the threat actor to access the camera to take pictures, record video and audio, get precise GPS location, view pictures from the device, as well as extract SMS messages, contacts, call logs, and even send SMS messages to the phone with attacker-controlled text. The amassed data is then shared with the C2 server.
Click to expand...

Zimperium: PhoneSpy: The App-Based Cyberattack Snooping South Korean Citizens

The mobile application poses a threat to Android devices by functioning as an advanced Remote Access Trojan (RAT) that receives and executes commands to collect and exfiltrate a wide variety of data and perform a wide range of malicious actions, such as: [...]

Upon infection, the victim’s mobile device will transmit accurate GPS locational data, share photos and communications, contact lists, and downloaded documents with the command and control server. Similar to other mobile spyware we have seen, the data stolen from these devices could be used for personal and corporate blackmail and espionage. The malicious actors could then produce notes on the victim, download any stolen materials, and gather intelligence for other nefarious practices.
Click to expand...

Log in or Sign up

Researchers Discover PhoneSpy Malware Spying on South Korean Citizens

guest Guest

Log in or Sign up

Researchers Discover PhoneSpy Malware Spying on South Korean Citizens

guest Guest

Useful Searches