Google Play app downloaded greater than 10,000 occasions contained data-stealing RAT

A malicious app downloaded from Google Play greater than 10,000 occasions surreptitiously put in a distant entry trojan that stole customers’ passwords, textual content messages, and different confidential information, a safety agency reported.

The trojan, which fits beneath the names TeaBot and Anatsa, got here to mild last May. It used streaming software program and abused Android’s accessibility companies in a means that allowed the malware creators to remotely view the screens of contaminated units and work together with the operations the units carried out. On the time, TeaBot was programmed to steal information from a predefined listing of apps from about 60 banks all over the world.

On Tuesday, safety agency Cleafy reported that TeaBot was again. This time, the trojan unfold via a malicious app known as QR Code & Barcode Scanner, which because the identify suggests, allowed customers to work together with QR codes and barcodes. The app had greater than 10,000 installations earlier than Cleafy researchers notified Google of the fraudulent exercise and Google eliminated it.

“One of many largest distinction[s], in comparison with the samples found throughout… Could 2021, is the rise of focused purposes which now embrace dwelling banking purposes, insurances purposes, crypto wallets, and crypto exchanges,” Cleafy researchers wrote. “In lower than a yr, the variety of purposes focused by TeaBot have grown greater than 500%, going from 60 targets to over 400.”

In latest months, TeaBot additionally began supporting new languages together with Russian, Slovak, and Mandarin Chinese language to show customized messages on contaminated telephones. The fraudulent scanner app distributed on Play was detected as malicious by solely two antimalware companies, and it requested just a few permissions on the time it was downloaded. All of the critiques portrayed the app as respectable and well-functioning, making TeaBot tougher for much less skilled individuals to acknowledge as a danger.

As soon as put in, the malicious QR Code & Barcode Scanner app displayed a pop-up informing customers that an replace was obtainable. However fairly than making the replace obtainable via Play as is regular, the pop-up downloaded it from two particular GitHub repositories created by a consumer named feleanicusor. The 2 repositories, in flip, put in TeaBot.

This graph provides an summary of the an infection chain developed by the TeaBot authors:

Cleafy researchers wrote:

As soon as the customers settle for to obtain and execute the faux “replace”, TeaBot will begin its set up course of by requesting the Accessibility Providers permissions in an effort to receive the privileges wanted:

• View and management display screen: used for retrieving delicate info corresponding to login credentials, SMS, 2FA codes from the machine’s display screen.
• View and carry out actions: used for accepting totally different sorts of permissions, instantly after the set up section, and for performing malicious actions on the contaminated machine.

TeaBot is simply the newest piece of Android malware to be unfold via Google’s official app market. The corporate is mostly fast to take away malicious apps as soon as they’re reported, nevertheless it continues to battle to determine malware by itself. Google representatives didn’t reply to an electronic mail in search of remark for this put up.

Tuesday’s put up from Cleafy has a listing of indicators that folks can use to find out in the event that they put in the malicious app.

Itemizing picture by Getty Images