Security firm FireEye announced on Wednesday that it has discovered a new malware (Kemoge) that attacks mobile devices and is circulating in more than 20 countries around the world.
It's called Kemoge, and it's hidden in apps on the Android platform, deceiving users. These apps are faithful copies of software that can be found on the Google Play Store.
According to the security company, their main difference is that they attack the user's device immediately after installation.
“The attacker uploads the applications to third-party app stores and promotes the download links via websites and through advertisements displayed in other mobile applications. Some aggressive advertising networks obtain root privileges, which makes it easier to install. Immediately after installation, Kemoge collects information about the device and uploads it to the ad server, while also starting to display advertisements. Its victims will see advertisements at regular intervals, regardless of what they do with the device (ads, and pop-ups even when the user remains on the Android home screen). “
According to FireEye, the data sent by the malware includes: the phone's IMEI, IMSI, as well as information from the storage space.
ArsTechnica also reports that log files from infected systems show which apps have root access on Android.
FireEye reports that many popular apps are being repackaged using the same name and icon and made available through third-party Stores.
These include applications such as WiFi Enhancer, Calculator, and Talking Tom 3, and of course they are available outside of the Google Play Store, where you will find the original ones.
Another proof that Android users should not use apps from third-party stores.
