Caution — 5 New Trojanized Android Apps Spying On Users In Pakistan


Cybersecurity researchers took the wraps away from a new spyware operation focusing on users in Pakistan that harnesses trojanized versions of legitimate Google android apps to carry out covert surveillance and espionage.

Designed to masquerade apps such as the Pakistan Citizen Porta l, a Muslim prayer-clock app called Pakistan Salat Time , Mobile Packages Pakistan , Registered SIMs Checker , and TPL Insurance , the malicious variants are already found to obfuscate their operations to stealthily down load a payload in the form of an Android Dalvik executable (DEX) file.

“The DEX payload contains most of the malicious features, which consist of the ability to covertly exfiltrate sensitive data like the user’s contact list and the full contents of SMS messages, ” Sophos danger researchers Pankaj Kohli and Andrew Brandt said.

“The app then sends this information to one of a small number of command-and-control websites hosted on servers situated in eastern Europe. ”

Interestingly, the fake website of the Pakistan Citizen Portal has been also prominently displayed in the form of a static picture on the Trading Corporation of Pakistan (TCP) website, potentially within an attempt to lure unsuspicious users into downloading the malware-laced app.

Visiting the particular TCP website (tcp. gov. pk) now shows the message “Down for Maintenance. ”

Besides the aforementioned apps, Sophos researchers also discovered a separate app called Pakistan Chat that will didn’t have a benign analogue distributed via the Google Enjoy Store. But the app was found to leverage the API of a legitimate chat company called ChatGum.

As soon as installed, the app requests invasive permissions, including the ability to gain access to contacts, file system, location, microphone, and read SMS messages, which allow it to gather the wide swathe of data on a victim’s device.

All these apps have one singular purpose — to conduct covert surveillance and exfiltrate the data from a target device. In inclusion to sending the unique IMEI identifier, the DEX payload electrical relays detailed profile details about the telephone, location information, contact lists, the particular contents of text messages, contact logs and the full index listing of any internal or SD card storage on the device.

Troublingly, the harmful Pakistan Citizen Portal app also transmits sensitive information such because users’ computerized national identity cards ( CNIC ) numbers, their passport details, and the username and password regarding Facebook as well as other accounts.

“The spying and covert surveillance capability of these modified Google android apps highlight the dangers of spy ware to smartphone users everywhere, inch Pankaj Kohli said. “Cyber-adversaries target mobiles not just to obtain their own hands on sensitive and individual information, but because they provide a real-time window into householder’s lives, their physical location, motions, and even live conversations using place within listening range of the infected phone. ”

If everything, the development is yet one more reason why users need to stay to trusted sources to download third-party apps, verify if an app is indeed built by a genuine developer, and carefully scrutinize app permissions before set up.

“In the present Android ecosystem, apps are cryptographically signed as a way in order to certify the code originates with a legitimate source, tying the particular app to its developer, inch the researchers concluded. “However, Android doesn’t do a good job exposing to the end user each time a signed app’s certificate isn’t legitimate or doesn’t validate. As such, users have no easy way of knowing if an app was indeed published by the genuine developer. ”

“This allows threat actors to develop and publish fake variations of popular apps. The presence of a large number of app shops, and the freedom of users to install an app from practically anywhere makes it also harder to combat such dangers. ”